--- title: "One Time Password" slug: "one-time-password" updated: 2026-06-08T17:44:02Z published: 2026-06-08T17:44:02Z canonical: "help.gladly.com/one-time-password" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://help.gladly.com/llms.txt > Use this file to discover all available pages before exploring further. # One Time Password | **REQUIRED USER ROLE** Administrator | **PERMISSION OVERVIEW** [View permissions by role](https://help.gladly.com/docs/managing-users-and-roles#roles-and-responsibilities) | | --- | --- | One Time Password (OTP) lets Gladly send a short verification code to a Customer's email address or phone number. When the Customer enters the code back, Gladly confirms whether it matched. This verifies that the customer controls the address before a [Workflow](/product-docs/docs/what-is-workflows) takes action on their behalf, such as looking up or canceling an order. > [!NOTE] > Using OTP in Workflows > > OTP is built to work with Gladly Workflows. The [**User address verification** template](/product-docs/docs/workflow-templates#user-address-verification) handles the full OTP flow out of the box. See [What is Workflows](https://help.gladly.com/docs/what-is-workflows) to learn more. ## Access One Time Password settings 1. Click ![](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/hamburger-menu-icon(1).svg) on the top-left corner of the screen. 2. Click **Settings**. 3. Under **Security and Compliance**, click **One Time Password**. ![Configuration settings for sending one-time passwords via email and SMS.](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/image-1780560994984.png) The page has two tabs: **Configuration** and **Audit log**. ## Configuration The Configuration tab contains the settings that control how OTP emails and SMS messages are sent from your organization. ![Configuration settings for one-time passwords, including email and SMS company name fields.](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/otp configuration.png) - **[A] Email Endpoint** — The email endpoint used to send one-time passwords to customers. Must be a valid email endpoint already configured for your org. Email OTP sends fail at send time until this is set. SMS-only orgs can leave this empty. - **[B] Company Name (Email)** — The company name shown in the email body when a one-time password is sent. Up to 100 characters. Falls back to your org's display name if left empty. - **[C] Company Name (SMS)** — The company name shown in the SMS body when a one-time password is sent. Up to 32 characters. Cannot contain links, phone numbers, special characters, or more than 4 digits. Falls back to your org's display name if left empty. SMS OTP is available to all orgs without additional setup. Email OTP requires an **Email Endpoint [A]** to be selected before it will work. ### What Customers see **Email:** Customers receive a styled email with the subject "Your [Brand Name] verification code." The email displays the brand name, the code in a prominent box, an expiry note, and a footer reminder to ignore it if they did not request it. The HTML template is fixed; only the brand name and From address vary by org. ![Email from Retalé containing a verification code that expires in ten minutes.](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/retale_emailotp.png) **SMS:** Customers receive a message in the format "Your [Brand Name] verification code is: [code]." The SMS body text is fixed and cannot be customized. ![A text message displaying a verification code and spam warning for Retalé.](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/sms otp.png) ## Audit log The Audit log tab lets you look up the full history of OTP activity for a specific customer address. The log does not show a default listing; results only appear after you enter an address. ![Configuration page for one-time passwords with an audit log search feature.](https://cdn.us.document360.io/7047b671-c4f2-4df0-bb0a-b9b511fd2452/Images/Documentation/otp audit log.png) Enter a customer's email address or phone number in the search field to load their OTP history. Each row represents one OTP request. The row label is the terminal event for that request, followed by a count of total lifecycle events recorded. Expand a row to see the full chronological sequence of events. #### Event types | Event | Meaning | | --- | --- | | Send requested | A Workflow requested a code to be sent. | | Send succeeded | The provider accepted the send request. | | Delivered | Confirmation that the code reached the recipient. | | Delivery failed | The provider could not deliver the code (invalid number, hard bounce, geographic restriction, etc.). | | Verification succeeded | The customer entered the correct code. | | Verification failed | The customer entered an incorrect code. | | Code expired | A verification attempt came in after the 10-minute validity window. | | Code invalidated | The code was retired after the maximum number of failed attempts. | | Trip wire triggered | The recipient entered too many wrong codes within an hour and entered a temporary cooldown period. | ## Common issues ****"I never got the code."**** Look for "Send succeeded" followed by "Delivery failed." This means the provider accepted the request but could not complete delivery, typically due to an invalid number, a hard-bounced email, or a geographic restriction. ****"The code isn't working."**** Look for "Verification failed" (wrong code entered) or "Code expired" (the customer waited longer than 10 minutes before entering the code). ****"I can't request a new code."**** Look for "Trip wire triggered." The recipient's address is temporarily blocked for 60 minutes due to too many failed verification attempts within an hour. *Customer* or C*ustomers* refers to the people you support through Gladly who buy or use your products or services.