OTP setup

Get Help
1

Trying to configure OTP on my database. I think I have done evrything correct
I do have a email-password database for the moment which uses email and password and want to add OTP as an additional option

  • I did setup my own email provider → mailgun
  • Then Authentication - paswordless
  • Universal login is on
  • Email as identifier is on on my database
  • On Email - did set Verification method to OTP
  • Authentication Pfofile is identifier first
  • Enabled Paswordless OTP on my application

Thats it, but on my connection -< email otp is not a valid
“authentication_methods”: {

        "passkey": {

            "enabled": false

        },

        "password": {

            "enabled": true,

            "api_behavior": "required",

            "signup_behavior": "allow"

        }

I tried to patch this using the managment API but get the error : “OTP authentication methods feature is not supported for this connection.”,

Any help? I’m on the free tier. Could it be that OTP is not possible fot this?

3

Hi @nlthoelen

Welcome back to the Auth0 community!

You are trying to configure OTP (One-Time Password) authentication on your email-password database connection in Auth0, but when you attempt to patch the connection using the Management API to add OTP to the authentication_methods property, you receive the error: “OTP authentication methods feature is not supported for this connection.”

OTP authentication methods cannot be added directly to a database connection. OTP is only supported as a passwordless authentication method on a separate passwordless email connection, not as an authentication method on a standard database connection. This is an architectural limitation in Auth0, not a configuration issue or a free-tier restriction.

[Root Cause]

Auth0 distinguishes between two separate connection types for email-based authentication:

  1. Database Connection (Username-Password-Authentication): Stores user credentials (email and password) and supports password-based authentication. This connection type does not support OTP as an authentication method.

  2. Passwordless Email Connection: A separate connection type designed specifically for passwordless authentication flows. This connection supports OTP (one-time password) as the primary authentication mechanism.

When you set “Email as identifier” on your database connection and configure “Verification method to OTP” in the Email settings, you are configuring email verification for new user signups, not passwordless OTP authentication. These are different features:

  • Email verification with OTP: Sends an OTP to verify a user’s email address during signup, but the user still logs in with their password.
  • Passwordless OTP authentication: Users log in using only an OTP sent to their email, without a password.

The error “OTP authentication methods feature is not supported for this connection” occurs because you are attempting to add OTP as an authentication method to a database connection, which is not supported. OTP authentication methods are only available on passwordless connections.

Recommended Approach:

To offer OTP as an authentication option to your users, you have two choices:

Option 1: Keep password authentication and add passwordless OTP as an alternative (Recommended)

  1. Keep your existing database connection for email-password authentication.
  2. Create a separate passwordless email connection for OTP-only authentication.
  3. Enable both connections on your application so users can choose to log in with either password or OTP.
  4. In your Universal Login UI, present both options: “Login with Password” and “Login with OTP”.

Steps:

  1. Navigate to Auth0 Dashboard → Connections → Passwordless.
  2. Click Email and ensure it is enabled.
  3. Configure the email provider (you have already done this with Mailgun).
  4. Navigate to Applications → Your Application → Connections.
  5. Enable both your database connection and the passwordless email connection for your application.
  6. In your Universal Login, allow users to choose between password and OTP login methods.

Option 2: Replace password authentication with passwordless OTP only

If you want to remove password authentication entirely and use only OTP:

  1. Disable the database connection on your application.
  2. Enable only the passwordless email connection on your application.
  3. Users will log in exclusively with OTP sent to their email.

Steps:

  1. Navigate to Auth0 Dashboard → Applications → Your Application → Connections.
  2. Disable the database connection (toggle off).
  3. Enable the passwordless email connection (toggle on).

Additionally, if you wish to use only the passwordless connection in your application, you have the option to pass the “connection=email” parameter inside the authorize call in order to force the users to authenticate only using email OTP.

Verification:

After enabling the passwordless email connection on your application, you should see it available in your Universal Login flow. The connection will support OTP-based authentication without requiring users to have a password.

Kind Regards,
Nik

4

Thx a lot Nik. Now i get it!

5

Just one more question Nik
So, if a user uses both … email and password as also the other connection email otp, this will be 2 separate users from the auth0 view ? So, i will see 2 separate userId for the same user email? Is that correct ?

6

That is correct.

Passwordless is treated as a different connection than the Email+Password one and will create two separate identities.

Additionally, there is the option to have a Passwordless authentication flow using a Database Connection, however, this feature is still in Early Access and is not available across free tenants at this time. You might be interested in using this as an alternate option in the future when it will hit GA(General Access).

Kind Regards,
Nik