> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Email OTP

One-time codes over email: send and check codes, verify an address, or reset a password.

## Request email verification with OTP

`POST /iam/v2/auth/email-otp/send-verification-otp`

Send verification OTP

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to send the OTP
- `type` `string` _(required)_: Type of the OTP

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/send-verification-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "type": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/send-verification-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    type: 'string'
  })
})
```

## Check email OTP

`POST /iam/v2/auth/email-otp/check-verification-otp`

Check if a verification OTP is valid

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address the OTP was sent to
- `type` `string` _(required)_: Type of the OTP
- `otp` `string` _(required)_: OTP to verify

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/check-verification-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "type": "email-verification",
  "otp": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/check-verification-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    type: 'email-verification',
    otp: 'string'
  })
})
```

## Verify email with OTP

`POST /iam/v2/auth/email-otp/verify-email`

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to verify
- `otp` `string` _(required)_: OTP to verify

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if the verification was successful
- `token` `string | null` _(required)_: Session token if autoSignInAfterVerification is enabled, otherwise null
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `email` `string` _(required)_
  - `emailVerified` `boolean`
  - `image` `string`
  - `createdAt` `string` _(required)_
  - `updatedAt` `string` _(required)_
  - `isAnonymous` `boolean`
  - `phoneNumber` `string`
  - `phoneNumberVerified` `boolean`

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/verify-email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "otp": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/verify-email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    otp: 'string'
  })
})
```

## Reset password with email OTP

`POST /iam/v2/auth/email-otp/reset-password`

Reset user password with OTP

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to reset the password
- `otp` `string` _(required)_: OTP sent to the email
- `password` `string` _(required)_: New password

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates whether the password was successfully reset

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/reset-password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "otp": "string",
  "password": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/reset-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    otp: 'string',
    password: 'string'
  })
})
```