Email OTP login using "verify_email_by_code" template instead of "auth_email_by_code"

Get Help
, , ,
1

While testing the login flow in my application, I noticed my custom template for auth_email_by_code (Authentication Email (Code)) was not being used during login after sending the code. Instead, verify_email_by_code (Verification Email (Code)) was being used. I was able to confirm this by using my custom template for verify_email_by_code (Verification Email (Code)).

“Email OTP for login” was active and both templates were enabled.

Am I misunderstanding the usage of these templates, or is there a misconfiguration somewhere?

Any answers are greatly appreciated!

3

Hi @Sahid.Rosas

Thank you for reaching out to us!

I understand that during login with “Email OTP for login” enabled, your custom auth_email_by_code (Authentication Email (Code)) template was not being used; instead, the verify_email_by_code (Verification Email (Code)) template was applied.

Possible cause

When a user attempts to log in using “Email OTP for login” and their email address has not yet been verified (email_verified: false in their user profile), Auth0 prioritizes the email verification step. Because of this, Auth0 triggers the Verification Email (Code) (verify_email_by_code) template to verify the email address while simultaneously handling the authentication step.

Once the user successfully inputs the code from that first email, their profile is updated to email_verified: true.

The Solution / Next Step:

To see your custom auth_email_by_code template in action, you can test the login flow using an existing user account that already has email_verified: true. For all subsequent logins by verified users, Auth0 will bypass the verification requirement and correctly trigger the Authentication Email (Code) (auth_email_by_code) template instead.

Please let us know if this helped overcome your issue!

Best regards,
Gerald

4

Hi @gerald.czifra

Thank you for the response!

Upon further testing I have confirmed that this is still happening even when attempting to log in via email OTP using a verified account.

Any more input about this behavior or, if it can be replicated would be appreciated. :raising_hands: