Email codes

An email code is a six-digit number sent to the person’s address. They type it into your app and are signed in. Unlike a link, a code works where links do not: in-app browsers, mail previews, and mobile apps where opening a link would leave the app.

In Studio

Users & auth → Sign-in → Sign-in & registration → Ways to sign in → Email code. Switch it on and save. (It is also on the Authentication flow screen as Email one-time code.) Customise the message under Email templates: Sign-in code. Two steps: ask for the code, then submit it.

await pawabase.auth.sendEmailCode({ email: "ada@example.com" });

// Later, when the person types the code:
const result = await pawabase.auth.verifyEmailCode({ email: "ada@example.com", code: "123456" });
if (result.status === "mfa_required") await result.verify(authenticatorCode);

pb.auth.send_email_code(email="ada@example.com")

result = pb.auth.verify_email_code(email="ada@example.com", code="123456")
if result.status == "mfa_required":
    result.verify(authenticator_code)

Option	Meaning
`createUser` / `create_user`	Defaults to creating an account for an unknown address. Pass `false` to sign in existing accounts only

Limits

A code lasts 10 minutes and allows 5 wrong attempts. After that, ask for a new one.
Requests are rate limited, so add a short wait before “send again”.
Using the code proves ownership of the inbox, so the address becomes verified.

A complete flow

function CodeSignIn() {
  const [step, setStep] = useState<"email" | "code">("email");
  const [email, setEmail] = useState("");
  const [code, setCode] = useState("");
  const [error, setError] = useState("");

  async function send() {
    await pawabase.auth.sendEmailCode({ email });
    setStep("code");
  }

  async function verify() {
    try {
      const result = await pawabase.auth.verifyEmailCode({ email, code });
      if (result.status === "mfa_required") {
        await result.verify(prompt("Authenticator code") ?? "");
      }
    } catch {
      setError("That code didn't work. Check it, or send a new one.");
    }
  }

  return step === "email" ? (
    <>
      <input type="email" value={email} onChange={(e) => setEmail(e.target.value)} />
      <button onClick={send}>Email me a code</button>
    </>
  ) : (
    <>
      <p>We sent a code to {email}.</p>
      <input inputMode="numeric" autoComplete="one-time-code" maxLength={6} value={code} onChange={(e) => setCode(e.target.value)} />
      <button onClick={verify}>Sign in</button>
      {error && <p>{error}</p>}
    </>
  );
}

autoComplete="one-time-code" lets phones fill the code from the message.

Be kind about errors

Say “if that address has an account, we sent a code”, not whether it exists.
Keep the email on screen so people don’t retype it.
Offer “send a new code” after a pause, and “use a link/password instead”.
Tell people to check spam, and make sure your sending address is set up under Mail.

Sign-in links

One click instead of typing.

Email templates

Change the wording.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Limits

A complete flow

Be kind about errors

Sign-in links

Email templates

​In Studio

​Sign in with a code

​Limits

​A complete flow

​Be kind about errors

Sign-in links

Email templates

In Studio

Sign in with a code

Limits

A complete flow

Be kind about errors