Update README.md

Author: benbjurstrom

README.md

@@ -242,32 +242,82 @@ Now when users visit `/login` or are redirected to the login page, they'll see t
 php artisan vendor:publish --tag="otpz-config"
 ```
 
-Available options:
-
+This is the contents of the published config file:
 ```php
+<?php
+
 return [
-    // OTP expiration time in minutes (default: 5)
-    'expiration' => 5,
+    /*
+    |--------------------------------------------------------------------------
+    | Expiration and Throttling
+    |--------------------------------------------------------------------------
+    |
+    | These settings control the security aspects of the generated codes,
+    | including their expiration time and the throttling mechanism to prevent
+    | abuse.
+    |
+    */
+
+    'expiration' => 5, // Minutes
 
-    // Multi-tier rate limiting
     'limits' => [
-        ['limit' => 1, 'minutes' => 1],   // 1 request per minute
-        ['limit' => 3, 'minutes' => 5],   // 3 requests per 5 minutes
-        ['limit' => 5, 'minutes' => 30],  // 5 requests per 30 minutes
+        ['limit' => 1, 'minutes' => 1],
+        ['limit' => 3, 'minutes' => 5],
+        ['limit' => 5, 'minutes' => 30],
     ],
 
-    // User model
+    /*
+    |--------------------------------------------------------------------------
+    | Model Configuration
+    |--------------------------------------------------------------------------
+    |
+    | This setting determines the model used by Otpz to store and retrieve
+    | one-time passwords. By default, it uses the 'App\Models\User' model.
+    |
+    */
+
     'models' => [
         'authenticatable' => App\Models\User::class,
     ],
 
-    // Custom mailable class
+    /*
+    |--------------------------------------------------------------------------
+    | Mailable Configuration
+    |--------------------------------------------------------------------------
+    |
+    | This setting determines the Mailable class used by Otpz to send emails.
+    | Change this to your own Mailable class if you want to customize the email
+    | sending behavior.
+    |
+    */
+
     'mailable' => BenBjurstrom\Otpz\Mail\OtpzMail::class,
 
-    // Email template
+    /*
+    |--------------------------------------------------------------------------
+    | Template Configuration
+    |--------------------------------------------------------------------------
+    |
+    | This setting determines the email template used by Otpz to send emails.
+    | Switch to 'otpz::mail.notification' if you prefer to use the default
+    | Laravel notification template.
+    |
+    */
+
     'template' => 'otpz::mail.otpz',
+    // 'template' => 'otpz::mail.notification',
+    
+    /*
+    |--------------------------------------------------------------------------
+    | User Resolver
+    |--------------------------------------------------------------------------
+    |
+    | Defines the class responsible for finding or creating users by email address.
+    | The default implementation will create a new user when an email doesn't exist.
+    | Replace with your own implementation for custom user resolution logic.
+    |
+    */
 
-    // User resolver (for finding/creating users by email)
     'user_resolver' => BenBjurstrom\Otpz\Actions\GetUserFromEmail::class,
 ];
 ```
@@ -334,50 +384,6 @@ Update `config/otpz.php`:
 
 ---
 
-## How It Works
-
-### Security Features
-
-1. **Session Locking**
-   - OTPs are tied to the browser session that requested them
-   - Prevents OTP reuse across different browsers/devices
-
-2. **Rate Limiting**
-   - Multi-tier throttling prevents abuse
-   - Default: 1/min, 3/5min, 5/30min
-
-3. **Signed URLs**
-   - All OTP entry URLs are cryptographically signed
-   - Invalid signatures are rejected
-
-4. **Automatic Invalidation**
-   - Used after first successful authentication
-   - Expired after configured time (default: 5 minutes)
-   - Invalidated after 3 failed attempts
-   - Superseded when new OTP is requested
-
-### Architecture
-
-```
-SendOtp Action
-    ↓
-Creates OTP → Sends Email
-    ↓
-User Clicks Link (Signed URL)
-    ↓
-AttemptOtp Action → Validates:
-    - URL signature
-    - Session ID match
-    - Status (ACTIVE)
-    - Expiration
-    - Attempt count
-    - Code hash
-    ↓
-Success → User Authenticated
-```
-
----
-
 ## Testing
 
 ```bash