scaffold solution for confirming OTP before enabling OTP;

app/controllers/devise_otp/devise/otp_confirm_tokens_controller.rb

@@ -0,0 +1,54 @@
+module DeviseOtp
+  module Devise
+    class OtpConfirmTokensController < DeviseController
+      include ::Devise::Controllers::Helpers
+
+      prepend_before_action :ensure_credentials_refresh
+      prepend_before_action :authenticate_scope!
+
+      #
+      # Displays the OTP
+      #
+      def show
+        if resource.nil?
+          redirect_to stored_location_for(scope) || :root
+        else
+          render "devise/otp_confirm_tokens/show"
+        end
+      end
+
+      #
+      # Confirms the OTP if valid
+      #
+      def update
+        if resource.valid_otp_token?(params[:otp_token])
+          resource.confirm_otp!
+          otp_set_flash_message :success, :successfully_updated
+          redirect_to otp_credential_path_for(resource)
+        else
+          otp_set_flash_message :failure, :otp_token_does_not_match
+          render "devise/otp_confirm_tokens/show"
+        end
+      end
+
+      private
+
+      def ensure_credentials_refresh
+        ensure_resource!
+
+        if needs_credentials_refresh?(resource)
+          otp_set_flash_message :notice, :need_to_refresh_credentials
+          redirect_to refresh_otp_credential_path_for(resource)
+        end
+      end
+
+      def scope
+        resource_name.to_sym
+      end
+
+      def self.controller_path
+        "#{::Devise.otp_controller_path}/confirm_otp_tokens"
+      end
+    end
+  end
+end

app/controllers/devise_otp/devise/otp_tokens_controller.rb

@@ -24,11 +24,14 @@ def show
       #
       def update
         enabled = params[resource_name][:otp_enabled] == "1"
-        if enabled ? resource.enable_otp! : resource.disable_otp!
+        if params[resource_name][:otp_enabled] == "1"
+          resource.reset_otp_credentials!
+          redirect_to confirm_otp_token_path_for(resource)
+        else
+          resource.disable_otp!
           otp_set_flash_message :success, :successfully_updated
+          redirect_to action: :show
         end
-
-        render :show
       end
 
       #

app/views/devise/otp_confirm_tokens/show.html.erb

@@ -0,0 +1,17 @@
+Confirm the OTP Token shown below:
+
+<%= otp_authenticator_token_image(resource) %>
+
+<p>
+  <strong><%= I18n.t('manual_provisioning', :scope => 'devise.otp.token_secret') %>:</strong>
+  <code><%= resource.otp_auth_secret %></code>
+</p>
+
+<%= form_with(:url => [resource_name, :otp_confirm_token], :method => :put) do |f| %>
+
+  <%= f.label :otp_token %>
+  <%= f.text_field :otp_token %>
+
+  <%= f.submit :enable %>
+
+<% end %>

lib/devise_otp_authenticatable/controllers/url_helpers.rb

@@ -21,6 +21,11 @@ def otp_token_path_for(resource_or_scope, opts = {})
         send("#{scope}_otp_token_path", opts)
       end
 
+      def confirm_otp_token_path_for(resource_or_scope, opts = {})
+        scope = ::Devise::Mapping.find_scope!(resource_or_scope)
+        send("#{scope}_otp_confirm_token_path", opts)
+      end
+
       def otp_credential_path_for(resource_or_scope, opts = {})
         scope = ::Devise::Mapping.find_scope!(resource_or_scope)
         send("#{scope}_otp_credential_path", opts)

lib/devise_otp_authenticatable/models/otp_authenticatable.rb

@@ -60,11 +60,13 @@ def reset_otp_persistence!
       save!
     end
 
-    def enable_otp!
+    def populate_otp!
       if otp_persistence_seed.nil?
         reset_otp_credentials!
       end
+    end
 
+    def confirm_otp!
       update!(otp_enabled: true, otp_enabled_on: Time.now)
     end
 

lib/devise_otp_authenticatable/routes.rb

@@ -15,11 +15,14 @@ def devise_otp(mapping, controllers)
           get :recovery
         end
 
+        resource :confirm_token, only: [:show, :update], path: mapping.path_names[:confirm_token], controller: controllers[:otp_confirm_tokens]
+
         resource :credential, only: [:show, :update],
           path: mapping.path_names[:credentials], controller: controllers[:otp_credentials] do
           get :refresh, action: "get_refresh"
           put :refresh, action: "set_refresh"
         end
+
       end
     end
   end