Email OTP Plugin
Email OTP Plugin 1.0.2 adds passwordless authentication with six-digit, single-use codes delivered by email. It integrates with Core’s shared sign-in UI through plugin metadata, so enabled deployments advertise Email me a sign-in code alongside the password flow.Security behavior
- Codes are stored as password hashes, never plaintext.
- A new request invalidates earlier active codes for the same email and business.
- Codes expire, are single-use, and have a verification-attempt limit.
- Requests have a configurable cooldown.
- Failed email delivery invalidates the generated code.
- Redirect targets are checked against the current host.