OTP turns a one-time code into the entire sign-in step — the user enters a username, receives a code, and is signed in without ever entering a password.
Overview
OTP is a password-family identity provider: it uses the same username step as the built-in login form, then sends and checks a one-time code instead of a password. It's different from OTP as MFA, which adds a code step after another method — like Email ID and Password — has already checked a password; both share the same code-delivery setup, but the OTP method runs it as the whole login. Add it from Settings › Security › New Identity Provider › OTP.
Use Cases
Passwordless sign-in: Remove passwords entirely for a group of users, relying on a code delivered to their email, SMS, or WhatsApp.
Low-friction guest or field-worker access: Let people sign in quickly without account setup overhead, especially since JIT Provisioning is already on by default for this method.
Delivery flexibility: Route the code through whatever channel your automation can reach — email, SMS, WhatsApp, or anything else a workflow can call.
Configuring the OTP Method
The form has three parts:
Button Label: the login-page button text (default "Continue with OTP").
OTP Configuration: the automations and limits — see below.
Additional Settings: JIT Provisioning (on by default for OTP), refresh token, session expiry, single-tab session, plus Login Restriction and its Login User Criteria Match.
OTP Trigger Automation
Your trigger automation is the code generator and sender, and it must return the code so the platform can check it later.
It receives: the identified user's id, so your automation can look up their phone or email from their profile.
It must: generate a one-time code, deliver it (SMS/email/etc.), and return the code to the platform.
Note:
If your trigger automation doesn't return a code, sign-in fails.
The platform stores that returned code in a short-lived session and later compares it to what the user types — so for standard code-based OTP you don't need a separate verification automation. The OTP Verification Automation field is only invoked for push-approval flows, where an external system approves instead of the user typing a code.
Rate Limits
Four independent limits protect the flow, each with an activity window, a threshold, and a lock duration:
Parameter | Description | Example |
|---|---|---|
Trigger OTP Rate Limit | How often a user can request a code. | "Default max 5" |
Resend OTP Rate Limit | How many times a user can resend a code. | "Default max 3" |
Verification Rate Limit | How many verification submissions are allowed. | "Default max 5" |
Failed Attempts Rate Limit | How many wrong codes are allowed; drives the remaining-attempts countdown on the Verify screen. | "Default max 5" |
Number of Retries sets the maximum OTP verification attempts allowed per session. Where you leave a limit unset, the platform applies defaults — about 5 attempts per 5-minute window, then a 30-minute lock. Exceeding any limit temporarily locks that user for the policy's lock duration, separate from account lockout, and it clears on its own.
Sign-In Flow
The user enters their username and selects "Continue with OTP".
The platform looks up that account (creating it if JIT Provisioning is on), confirms it's Active, and runs your OTP Trigger Automation, which sends a code to the contact details on that user's profile.
The user is taken to the Verify OTP screen and enters the code.
The platform checks the code against the one your automation returned; on success the session is created, subject to Login Restriction and any error limits.
Note:
The verification session lasts about 5 minutes; "Resend OTP" issues a fresh code and restarts the timer.
Error Messages
"Invalid OTP" — wrong code, shown with the remaining attempts.
"Invalid session" / "Request activity has timed out. Please log back in." — the ~5-minute code window expired; start over.
"Maximum trigger OTP reached. Please try again after …" — too many code requests.
"Maximum resend OTP attempts reached. Please try again after …" — too many resends.
"Maximum verification attempts reached. Please try again after …" / "Maximum failed attempts reached. Please try again after …" — verification limits hit.
"User is temporarily locked. Please try again after …" — the user is in a rate-limit lock; wait it out.
You can override any of these messages per method — custom text for session-expired, user-locked, and each of the trigger, resend, verification, and failed-attempt limits.
Notes
OTP puts your trigger automation on the critical path of every sign-in, so its reliability and your rate limits deserve deliberate attention:
Make sure your OTP Trigger Automation always returns the code it generated — a missing code fails every sign-in.
Set the four rate-limit policies deliberately rather than leaving all of them at their defaults, especially if the delivery channel has its own cost or throughput limits.
Remember JIT Provisioning defaults to on for OTP, unlike most other methods — turn it off if you don't want unrecognized usernames to create accounts automatically.
Customize the session-expired, user-locked, and rate-limit error messages if the defaults don't match your support flow.
Pair a Custom Workflow identity provider with a custom login screen if you need phone-number sign-in rather than username-based OTP.