One-Time Password

​

One-Time Password (OTP)

Single-use codes sent via email for secure, passwordless authentication.

​

How It Works

1. User enters their email address
2. System generates a one-time code and sends it to the user’s email
3. User inputs the code to verify their identity
4. Upon validation, access is granted

A code works for 10 minutes and only once. After it has been used, it can’t sign anyone in again, even within the 10 minutes. When someone asks for a code, the sign-in page always says “If that email can sign in with a code, one is being sent. If nothing arrives in a few minutes, check your spam folder or try again later.” It says the same thing for an email with no account, so the page never reveals who has an account. A code is only sent when the account exists and isn’t locked. A wrong, expired or already-used code gets “That sign-in code isn’t right. Check the most recent code in your email, or request a new one.” Five wrong codes in a row lock the account for 24 hours, the same as for passwords (see How sign-in protects accounts).

​

Configuration To enable OTP authentication:

1. Navigate to Authentication Settings
2. Toggle on “One-Time Password”
3. Ensure SMTP settings are properly configured

​

Requirements - Functional SMTP configuration - Valid email addresses for all users