SMS and email one-time codes
Self-service enrolment and verification endpoints for an SMS code and an email code or magic link — real today, but not yet an option the login screen offers when it asks for a second factor.
Qorionix now has self-service enrolment and verification for two more one-time-code channels: SMS and email. Both exist as real, working endpoints today. Read the callout below before you plan around either — they are not yet part of the challenge the login screen presents when it asks for a second factor.
SMS one-time codes
POST /auth/mfa/sms/enroll and POST /auth/mfa/sms/enroll/verify enrol a phone number and confirm it with a code. The destination is read from your profile's mobilePhone attribute — the same base attribute described in Profile fields and custom attributes — so it has to be populated before you can enrol.
Sending is rate-limited to 5 sends per 24 hours, per organisation, per user, per channel. That is a real ceiling, not advisory — the sixth attempt in a day is refused.
Errors you may see: no_phone_on_profile if mobilePhone isn't set, otp_rate_limited at the 5-per-24h ceiling, otp_invalid for a wrong code, and invalid_or_expired_token for a stale challenge.
Email one-time codes and magic links
Two related mechanisms, both over your existing verified email address:
- Email OTP —
POST /auth/mfa/email/otpto send a code,POST /auth/mfa/email/otp/verifyto confirm it. - Email magic link —
POST /auth/mfa/email/magic-linkto send a one-click link,POST /auth/mfa/email/magic-link/verifyto confirm it (or to consume the link itself).
Both are sent through your existing SMTP configuration, so — unlike SMS — there is no separate provider dependency to worry about; if your deployment sends any mail today, it can send these.
The mail itself is templated and previewable
The OTP and magic-link mail, along with account activation and lockout notices, now render through a real per-organisation email template system: four-step resolution (your organisation's own translation for the recipient's locale, then your organisation's English version, then the platform default in the recipient's locale, then the platform English default), with platform defaults seeded for activation, otp, magic_link, lockout and factor_enrollment. Administrators can view, edit and preview a template — rendered against sample data, without sending — at GET/PUT/DELETE /organizations/{orgID}/email-templates/... and .../preview. There is no "send yourself a real test email" button yet, only the server-side preview render.
What this article deliberately does not cover
The password-reset and email-verification flows have their own, separate sender path and are not part of this template system — see Password policy and lockout for those. And as stated above, neither SMS nor email OTP currently appears as an option when a sign-on policy's second-factor challenge is presented at login; both remain self-service-only until that wiring lands.