1. Docs
  2. API Reference
  3. Trigger an email OTP for an in-flight MFA challenge

Trigger an email OTP for an in-flight MFA challenge

POST/v1/identity/auth/mfa/challenge/email-otp/send

Request body

  • challenge_tokenstring*

    Challenge token returned by /v1/identity/auth/login when `requires_mfa_challenge` was true.

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/v1/identity/auth/mfa/challenge/email-otp/send" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string"
  }'

Responses

204 Generates an 8-digit code, persists its hash on the challenge row, and emails the plaintext to the identity's verified address. Rate-limited to one send per 60s per challenge. Returns 204.
400 Email OTP cannot be issued — the identity has no verified email, or env.settings.mfa_factor_allowlist excludes email_otp
401 Challenge token is missing, expired, already consumed, or locked after too many failed attempts
On this page

Related endpoints

POSTSubmit a TOTP code to satisfy an in-flight MFA challenge
POSTRedeem a single-use recovery code to satisfy an in-flight MFA challenge
POSTGenerate WebAuthn authentication options for an in-flight MFA challenge
POSTSubmit a WebAuthn assertion to satisfy an in-flight MFA challenge
POSTSubmit an email OTP to satisfy an in-flight MFA challenge