Email OTP

All Web SDK methods for email OTP require you to initiate an action first. Check out our guide on email OTP authentication for more details.

Enroll

Start enrollment for a new email OTP authenticator by sending the user an email containing an OTP code. This method is typically used when you’ve not yet verified the user’s email address.

const response = await authsignal.email.enroll({ email: "jane.smith@authsignal.com" });

If you’ve already verified a user’s email address independently of Authsignal, you can alternatively use a Server SDK to enroll the user programmatically.

Parameters

string

The user’s email address.

Response

AuthsignalResponse<EnrollResponse>

Show properties

EnrollResponse

Show properties

string

The ID of the Authsignal user.

string

The ID of the Authsignal user authenticator.

string

See the Error handling section for more details.

string

Challenge

Start re-authentication for an existing email OTP authenticator by sending the user an email containing an OTP code. This method is typically used when you’ve already verified the user’s email address.

const response = await authsignal.email.challenge();

Response

AuthsignalResponse<ChallengeResponse>

Show properties

ChallengeResponse

Show properties

string

The ID of the Authsignal challenge.

string

See the Error handling section for more details.

string

Verify

Finish enrolling or re-authenticating a new or existing email OTP authenticator by verifying the code submitted by the user.

const response = await authsignal.email.verify({ code: "123456" });

Parameters

string

The OTP code inputted by the user.

Response

AuthsignalResponse<VerifyResponse>

Show properties

VerifyResponse

Show properties

boolean

required

True if the verification was successful.

string

A token which can be used for server-side validation.

object

Only present on first time verification e.g. enrollment.

Show properties

string

required

The ID of the Authsignal user authenticator.

required

string

required

The date and time the authenticator was created in ISO 8601 format.

string

required

The date and time the authenticator was first verified in ISO 8601 format.

string

The date and time the authenticator was last verified in ISO 8601 format.

boolean

required

Whether the authenticator is the default authenticator for the user.

string

The email address of the authenticator. Only present for email authenticators e.g. email OTP and email magic link.

string

The phone number of the authenticator. Only present for phone authenticators e.g. SMS/WhatsApp OTP.

SMS | WHATSAPP

The previous SMS channel used to send the OTP code. Only present for phone authenticators e.g. SMS/WhatsApp OTP.

string

Only present for passkey authenticators.

Show properties

string

required

The ID of the passkey credential.

string

required

The device ID of the passkey credential.

string

The name of the passkey credential.

string

The AAGUID of the passkey credential.

boolean

required

Whether the passkey credential is backed up.

'singleDevice' | 'multiDevice'

The device type of the passkey credential.

object

The parsed user agent of the passkey credential.

Show properties

string

required

The user agent of the passkey credential.

object

The browser of the passkey credential.

Show properties

string

The name of the browser.

string

The version of the browser.

string

The major version of the browser.

object

The device of the passkey credential.

Show properties

string

The model of the device.

string

The type of the device.

string

The vendor of the device.

object

The engine of the passkey credential.

Show properties

string

The name of the engine.

string

The version of the engine.

object

The OS of the passkey credential.

Show properties

string

The name of the OS.

string

The version of the OS.

object

The CPU of the passkey credential.

Show properties

string

The architecture of the CPU.

string

required

The date and time the passkey credential was verified in ISO 8601 format.

'platform' | 'cross-platform'

The authenticator attachment of the passkey credential.

string

The AAGUID mapping of the passkey credential.

Show properties

string

required

The name of the AAGUID mapping.

string

The SVG icon of the AAGUID mapping in light mode.

string

The SVG icon of the AAGUID mapping in dark mode.

string

A structured code present if the verification failed due to user error. Possible values are: CODE_INVALID_OR_EXPIRED or MAX_ATTEMPTS_EXCEEDED.

string

See the Error handling section for more details.

string

Server

Client

Call Connect

Enroll

Parameters

Response

Challenge

Response

Verify

Parameters

Response

​Enroll

​Parameters

​Response

​Challenge

​Response

​Verify

​Parameters

​Response

Enroll

Parameters

Response

Challenge

Response

Verify

Parameters

Response