Possible secret leak into error from url.Parse.

https://github.com/cristalhq/otp/blob/main/otp.go#L79

In case of invalid url url.Parse returns error with full string in it, that can leak OTP secret into logs.

This either should be highlighted in docs or plugged-in with custom error messages instead of the one that comes from url.Parse.

Redacted example of error

parse "otpauth://totp/[email protected]:00000000-0000-0000-0000-000000000000?digits=6&secret=***&period=30&algorithm=SHA1&issuer=user%40domain.com\n": net/url: invalid control character in URL

Consider changing Period field type to uint64 (or vice-versa) in TOTPConfig for better API consistency.

https://github.com/cristalhq/otp/blob/main/totp.go#L19

	otpAuthParsed, err := otp.ParseKeyFromURL(otpAuthURL)
	if err != nil {
		return nil, fmt.Errorf("error parsing OTPAuthURL: %w", err)
	}

	totp, err := otp.NewTOTP(otp.TOTPConfig{
		Algo:   otpAuthParsed.Algorithm(),
		Digits: otpAuthParsed.Digits(),
		Issuer: otpAuthParsed.Issuer(),
		Period: uint(otpAuthParsed.Period()),
		Skew:   2,
	})

(P.S. Not big of a deal, will just look prettier)

There is no need to allocate a slice, it's enough to calculate all counters one by one and validate them.

ParseKeyFromURL Is missing some of the helper functions for fields, refs below:

• https://github.com/google/google-authenticator/wiki/Key-Uri-Format#counter
• https://github.com/google/google-authenticator/wiki/Key-Uri-Format#algorithm
• https://github.com/google/google-authenticator/wiki/Key-Uri-Format#digits

Would be nice to have them all and use Key object as a building block for TOTPConfig/HOTPConfig