Email & SMS codes

A one-time code (OTP) is a short numeric code Atlas sends to the user's email or phone. The user types it back to prove they control that address or number — no password required.

When to use codes

• Consumer apps that want the lowest sign-up friction.

• As a passwordless primary method, or as a fallback when a user forgets a password.

• As a second factor in an MFA policy.

Enable email codes

1. Sign-in methods → Email verification code → toggle on.

2. Set the code length and expiry.

3. Customize the delivery email under Email & SMS templates.

Enable SMS codes

1. Sign-in methods → SMS verification code → toggle on.

2. Configure your SMS sender / region settings.

3. Customize the SMS template.

How it works

1. User enters their email or phone.

2. Atlas generates a single-use code, stores only a hashed form, and sends it.

3. User enters the code; Atlas verifies it, enforces expiry, and rate-limits attempts to stop brute force.

4. On success, a session is issued.

Security notes

• Codes are single-use and short-lived; repeated wrong entries trigger a per-account freeze.

• SMS is convenient but weaker than an authenticator app or passkey — prefer passkeys or TOTP for high-value second factors.

Next

Offer one-click sign-in from the inbox → Magic links.