Customizing One-time Password (OTP)
Customize your OTP authentication flow from the Descope console (Settings > Authentication Methods > One-time Password).
A one-time password (OTP) is an automatically generated string sent to the user during the onboarding (sign-up or sign-in) process to authenticate that user. The OTP can be sent to an email address or a mobile phone as a text. A typical method for implementing OTP has two sets of functionality you need to program: user interaction and session verification.
Settings Summary
All Settings
Variables are displayed below and in the console as {{variable_name}}.
| Setting | Variable | Details |
|---|---|---|
| Domain | {{domain}} | URL domain used in email or text message sent to the end user |
| Expiration time | {{expirationTime}} | length of time after which link or code expires |
| {{code}} | Code or link sent to end user. This is not configurable and is generated by Descope | |
| Connector | Who will be listed as the sender of the OTP. The default is Descope. | |
| Template | If you are using a customized connector, you can change the template of the email/sms which your user will receive. The default is System. | |
| Enable method in API and SDK | This toggle switch enables or disables the authentication method from being available for use within API and SDK |
Additional Details
This section describes additional details about the configuration options available.
Expiration Time
For increased security, we recommend an expiration time of 3-5 minutes. A shorter expiration time limits how long a malicious actor has to attempt an attack (such as a dictionary or brute force attack) on the code or link.
Connectors
Email Connector
Descope supports utilizing your email connector. Currently, SMTP connectors and Sendgrid connectors are supported. You can configure an email connector by going to the applicable authentication method within the Descope console and clicking on the Email Connector, clickingadd Sendgrid connector or add SMTP connector and configuring the necessary information.Text Message (SMS) Connector
Descope supports utilizing your own Twilio account to send Text Messages. You can configure a Twilio connector by going to the applicable authentication method within the Descope console, then clicking on the Text Message Connector, and then clickingadd Twilio connector. You can then select the authentication method to authenticate with Twilio. The options for the connection auth method are AuthToken or API Key.