Email & SMS one-time codes

One-time passcodes let a user sign in (or add a factor) with a short code sent to their email or phone — no password. Atlas drives it through the same client flow as every other method; you enable it per-instance and the SDK/hosted pages render it.

Enable it

In Customization → Authentication → Methods, turn on Email code and/or SMS code. Configure the sender (email template / SMS provider) under Messaging.

The flow

1. The user enters their identifier (email or phone).

2. Atlas sends a code and the attempt moves to needs_first_factor.

3. The user enters the code; on success the attempt completes and exchanges for a session — identical to any other sign-in.

The React SDK, hosted pages and embed widget all render the code step; nothing app-side to build. Codes are short-lived and rate-limited; repeated failures trip the same abuse protection as password sign-in.

As a second factor

Email/SMS OTP can also serve as an MFA factor (see MFA & authenticator). The enrollment + challenge steps ride the same attempt state machine.