> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Email OTP

One-time codes over email: send and check codes, verify an address, or reset a password.

## Request email verification with OTP

`POST /iam/v2/auth/email-otp/send-verification-otp`

Send verification OTP

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to send the OTP
- `type` `string` _(required)_: Type of the OTP

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`: Whether the operation succeeded.

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/send-verification-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "type": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/send-verification-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    type: 'string'
  })
})
```

## Check email OTP

`POST /iam/v2/auth/email-otp/check-verification-otp`

Check if a verification OTP is valid

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address the OTP was sent to
- `type` `string` _(required)_: Type of the OTP
- `otp` `string` _(required)_: OTP to verify

### Responses

#### `200`: Success

Body (`application/json`):

- `success` `boolean`: Whether the operation succeeded.

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/check-verification-otp \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "type": "email-verification",
  "otp": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/check-verification-otp', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    type: 'email-verification',
    otp: 'string'
  })
})
```

## Verify email with OTP

`POST /iam/v2/auth/email-otp/verify-email`

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to verify
- `otp` `string` _(required)_: OTP to verify

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if the verification was successful
- `token` `string | null` _(required)_: Session token if autoSignInAfterVerification is enabled, otherwise null
- `user` `object` _(required)_: The signed-in user.
  - `id` `string` _(required)_: The user ID.
  - `name` `string` _(required)_: The user's display name.
  - `email` `string` _(required)_: The user's email address.
  - `emailVerified` `boolean`: Whether the email address has been verified.
  - `image` `string`: Profile image URL, when the auth provider supplied one.
  - `createdAt` `string` _(required)_: When the user was created, as an ISO 8601 timestamp.
  - `updatedAt` `string` _(required)_: When the user was last updated, as an ISO 8601 timestamp.
  - `isAnonymous` `boolean`: Whether this is an anonymous (guest) user.
  - `phoneNumber` `string`: The user's phone number, when one is linked.
  - `phoneNumberVerified` `boolean`: Whether the phone number has been verified.

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/verify-email \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "otp": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/verify-email', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    otp: 'string'
  })
})
```

## Reset password with email OTP

`POST /iam/v2/auth/email-otp/reset-password`

Reset user password with OTP

### Request body (required) (`application/json`)

- `email` `string` _(required)_: Email address to reset the password
- `otp` `string` _(required)_: OTP sent to the email
- `password` `string` _(required)_: New password

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates whether the password was successfully reset

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/email-otp/reset-password \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "string",
  "otp": "string",
  "password": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/email-otp/reset-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'string',
    otp: 'string',
    password: 'string'
  })
})
```