Email OTP

Email OTP is the same idea as magic links, but the user types a 6-digit code instead of clicking a link. Useful when users sign in on a different device than they read email on — and harder to phish.

Turn it on

// src/auth.config.ts
plugins: {
  emailOTP: { enabled: true },
},

Send + verify (client)

// 1. Send the code
await authClient.emailOtp.sendVerificationOtp({
  email,
  type: "sign-in", // or "email-verification" | "forget-password"
});

// 2. User enters the 6-digit code
await authClient.signIn.emailOtp({
  email,
  otp,
});

The three types

• sign-in — log the user in (no password).
• email-verification — verify a user's email after sign-up.
• forget-password — initiate a password reset with a code.

The send function in src/lib/email.ts → sendOTPEmail switches the subject line based on type. Template lives at src/lib/emails/otp-email.tsx.