Skip to main content

About Email OTP

Signicat's Email OTP is an authentication method based on one-time passwords (OTP) sent by email.

Use cases

A typical scenario may be:

Scenario 1
  • An end-user wants to access your application that requires authentication.
  • Your application backend (via Signicat Email OTP) sends an email with an OTP code to the end-user.
  • The end-user enters the code and successfully authenticates.
  • You receive the end-user's email address as part of the response from Signicat.

In cases when you already know the user's email address, the scenario would be:

Scenario 2
  • You already know the email address of an end-user.
  • An end-user wants to access your application that requires authentication.
  • Your application backend (via Signicat Email OTP) sends an email with an OTP code to the end-user.
  • The end-user enters the code and successfully authenticates.
  • You receive a confirmation (true or false) in the response from Signicat.

Although Email OTP alone does not provide a high level of security, from a technical standpoint there is nothing that prevents a customer from using it as a standalone authentication method.

However, it is more common and recommended to use Email OTP to boost an existing login process. Email OTP integrated with any username/password login solution will form a two-factor authentication method.

Technical details

Here are some technical details about Email OTP:

  • An OTP code is 6 characters long. The code is a string of numerical digits. For example, 012345.
  • An OTP code is valid for three minutes. After that time, the OTP code expires and the end-user must request a new one.
  • The end-user can request up to three OTP codes within an authentication session. The authentication session window lasts for five minutes. After that, the end-user needs to start over.
  • An end-user has three attempts to enter the correct code. If authentication fails, the end-user needs to start over.
  • User authentication expires after 24 hours. After that time, the end-user receives a new OTP code when they try to access the service. Authentication expiration ensures additional security.

User journey

When authenticating with Email OTP, the user journey looks like this:


Ready to see it in action? Follow the steps in the Setup guide to configure Email OTP in the Dashboard.