Skip to main content
Many apps gate sign-in behind a one-time password — an email or SMS code you have to receive and type back in. Autosana ships built-in hooks that handle this for you: each run leases a real inbox (or phone number), the agent enters that address during the flow, the incoming code is captured, and the agent reads it and types it in — no shared test account, no hard-coded code.

​
How it works

A built-in hook runs as a flow setup hook, before the agent starts. It:
  1. Leases a fresh, single-use address for that run and exposes it to the flow as an environment variable.
  2. Receives the provider’s email (or SMS) at that address and stores the code.
  3. Lets the agent read the code back and enter it to complete sign-in.
Each address is minted per run and never reused, so parallel runs never collide.

​
Built-in hooks

Add these from the Hook Library — on the Hooks page, click Add from Library.
Lease phone number appears in the library as Coming soon and can’t be added yet while we complete carrier (Twilio) approval. Email OTP is fully available today.

​
Email OTP

​
1. Add the hook to your organization

On the Hooks page, click Add from Library, then Add on Lease email address. This adds it once for your organization; you can then attach it to any flow.

​
2. Attach it as a flow setup hook

Open the flow, expand Advanced → Setup Hooks, and add Lease email address. Setup hooks run in order before the flow begins.
Email OTP is a flow setup hook — it provisions the inbox for the whole flow. It isn’t offered in teardown or suite slots.

​
3. Reference the address in your instructions

Once attached, the hook exposes AUTOSANA_EMAIL_ADDRESS for the run. Reference it in your flow steps like any other variable:
The agent enters the leased address, waits for the code to arrive at that inbox, reads it, and types it in. You’ll see the setup hook and its output at the top of the run’s Agent Actions:
Keep the sign-in steps in the app’s own vocabulary (“Continue with email”, “Enter the code”) and let the agent handle the rest — you don’t need to script polling the inbox or reading the code.

​
SMS OTP (coming soon)

Lease phone number works the same way for phone-based 2FA: it leases a real test phone number for the run and exposes AUTOSANA_PHONE_NUMBER (E.164) and AUTOSANA_PHONE_NUMBER_NATIONAL (without the country code) for the agent to receive an SMS login code. It’s shown in the library as Coming soon until carrier approval is complete.

​
Rolling your own

If you’d rather return a magic link or OTP from your own server instead of leasing an inbox, you can do that with a script hook — see Hooks for returning a code via a cURL request.