Skip to main content

​
Core integration

The wheel installs plugins.email_otp. Its metadata mounts the URL namespace at /otp/, marks the sign-in route public, and contributes Email me a sign-in code to Core’s generic sign-in options.

​
Model and lifecycle

EmailOTP stores the normalized email, business ID, hashed code, creation/expiration times, used state, and verification-attempt count.
  1. /otp/signin/ validates an email and enforces the cooldown.
  2. Existing active codes for that email/business are invalidated.
  3. A hashed six-digit code is saved and the plaintext code is sent by email.
  4. /otp/signin/verify/ validates expiry, use state, attempt count, and the hash.
  5. A matching active profile is authenticated; otherwise the verified email is carried into signup.

​
Routes

  • /otp/signin/: request a code (email_otp:request).
  • /otp/signin/verify/: submit and verify a code (email_otp:verify).