# Test accounts

Test accounts let you authenticate into your app without receiving a real email or SMS. They are useful for:

* **Automated testing** — build end-to-end tests that log in without hitting real email/SMS providers.
* **Local development** — quickly sign in during development without waiting for OTP delivery.
* **App Store review** — provide Apple or Google reviewers with working credentials so they can test your app.

Each time you enable a test account, Openfort generates a fresh set of credentials and revokes any previous ones.

:::info
Your app must have **email** or **phone (SMS)** login enabled to use test accounts. Other login methods (social, wallet, third-party) are not covered by test accounts and should be tested by completing those flows directly.
:::

## Enable test accounts

### Using the dashboard

1. Go to **Authentication providers** in the [Openfort Dashboard](https://dashboard.openfort.io) and scroll to the **Advanced** section.
2. Turn on the **Test account** toggle.

Once enabled you will see the generated login credentials: a test **email**, a test **phone number**, and a fixed **OTP code**.

### Using the API

Send a `POST` request to the authentication configuration endpoint with the `test_account` provider:

```bash
curl https://api.openfort.io/iam/v1/oauth \
  -X POST \
  -H "Authorization: Bearer $OPENFORT_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "test_account",
    "enabled": true
  }'
```

The response contains the generated credentials:

```json
{
  "provider": "test_account",
  "enabled": true,
  "emailSuffix": "a1b2",
  "phoneSuffix": "0123",
  "otpCode": "456789"
}
```

To disable the test account, send the same request with `"enabled": false`. Disabling preserves the existing credentials but stops them from working.

## Test credentials format

All test credentials follow a fixed format. Substitute the values from the dashboard or API response:

| Credential | Format | Example |
|---|---|---|
| Email | `test-{emailSuffix}@openfort.io` | `test-a1b2@openfort.io` |
| Phone | `+1555555{phoneSuffix}` | `+15555550123` |
| OTP | `{otpCode}` (6 digits) | `456789` |

:::warning
You **must** use the exact credentials shown in the dashboard or API response. You cannot substitute arbitrary values or use [plus addressing](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online).
:::

## How it works

When a user logs in with a test email or test phone number:

1. **OTP generation is skipped** — the API returns the fixed OTP code from the test account configuration instead of generating a random one.
2. **Email/SMS delivery is skipped** — no email or text message is sent. The OTP is only available through the dashboard or API response.
3. **Authentication proceeds normally** — after entering the correct OTP, the test user receives a valid session just like any other user.

This means a test user can complete the full login flow without any external dependency on email or SMS providers.

## Re-enabling test accounts

Each time you enable (or re-enable) the test account toggle, Openfort generates **new credentials**. The previous email, phone number, and OTP are revoked immediately. Update any automated tests or review credentials accordingly.

## Retrieving test credentials

To fetch the current test account credentials via the API:

```bash
curl https://api.openfort.io/iam/v1/oauth/test_account \
  -H "Authorization: Bearer $OPENFORT_SECRET_KEY"
```

This returns the same credential object shown above, including `emailSuffix`, `phoneSuffix`, and `otpCode`.