OTP

Coming soon. Managed OTP challenges — create, verify, expire, and rate-limit one-time codes — are planned, not shipped. The shape below is the design target, not documentation of a live API.

Intended shape: email-based challenges with expiration, attempt limits, and replay prevention.

Today’s workaround

Generate codes in your application, send them as ordinary transactional emails with an idempotency key, and verify them in your own store with a short TTL and a five-attempt cap. When managed OTP lands, migration is a endpoint swap, not a redesign.