Skip to main content
Many apps gate sign-in behind a one-time password — an email or SMS code you have to receive and type back in. Autosana ships built-in hooks that handle this for you: each run leases a real inbox (or phone number), the agent enters that address during the flow, the incoming code is captured, and the agent reads it and types it in — no shared test account, no hard-coded code.

​
How it works

A built-in lease hook executes as a flow setup hook, before the agent starts. You can attach it directly to one flow or add it once to a suite’s setup hooks so every member flow inherits it. It:
  1. Leases an address for that run alone and exposes it to the flow as an environment variable.
  2. Receives the provider’s email (or SMS) at that address and stores the code.
  3. Lets the agent read the code back and enter it to complete sign-in.
No two runs ever hold the same address at the same time, and a run only ever reads codes that arrive while it holds one — so parallel runs can’t read each other’s codes. The two hooks get there differently: email addresses are minted fresh for each run and never reused, while phone numbers come from a shared pool and go back when the run ends.

​
Built-in hooks

In the dashboard, add these from the Hook Library: on the Hooks page, click Add from Library. Code-managed flows and the MCP can use them without adding them first.

​
Email OTP

​
1. Add the hook to your organization

On the Hooks page, click Add from Library, then Add on Lease email address. This adds it once for your organization; you can then attach it to any flow or suite. Code-managed flows and the MCP add it for you, so you can skip this step there.

​
2. Attach it as a setup hook

For one flow, open the flow, expand Advanced → Setup Hooks, and add Lease email address. To use email OTP across a suite, edit the suite and add it under Advanced → Setup Hooks instead. Each member flow receives its own inbox, including when the suite runs members in parallel.
Email OTP always executes for one flow run. A suite attachment is an inherited default, not one inbox shared by the suite. If the suite has an auth setup flow, that flow receives its own inbox before its instructions run. The hook isn’t offered in teardown slots.

​
3. Reference the address in your instructions

Once attached, the hook exposes AUTOSANA_EMAIL_ADDRESS for the run. Reference it in your flow steps like any other variable:
The agent enters the leased address, waits for the code to arrive at that inbox, reads it, and types it in. You’ll see the setup hook and its output at the top of the run’s Agent Actions:
Keep the sign-in steps in the app’s own vocabulary (“Continue with email”, “Enter the code”) and let the agent handle the rest — you don’t need to script polling the inbox or reading the code.

​
SMS OTP

Lease phone number works the same way for phone-based 2FA. Add it from the Hook Library, then attach it to a flow or suite under Advanced → Setup Hooks. A suite attachment leases a separate number for each member flow, so parallel members never share a number. It isn’t offered in teardown slots. It gives you the number in two forms, because sign-in screens ask for it differently: Write the steps the way the screen reads:
The number is held for the whole run and released when it ends, so a later run never reads your code.
Test numbers are drawn from a shared pool, so runs that need one can queue behind each other at high concurrency. If a run reports that no number was free, it waited and then gave up — rerun it, or get in touch and we’ll grow the pool.

​
Code-managed flows and the MCP

You don’t need the Hook Library to use these hooks from code. In a code-managed flow or suite, list the hook’s slug in setup_hooks:
If your organization hasn’t added the hook yet, the sync adds it. With the MCP, include the hook in the hooks list of flows_create, flows_update, suites_create, or suites_update:
Use lease_phone_number for Lease phone number. The MCP adds the hook to your organization if it isn’t there yet, then attaches it.

​
Reusing the code

When the agent reads a code from the leased inbox or number, it saves it as AUTOSANA_OTP_CODE. Scripts that run later in the run, including teardown hooks, receive it like any other variable. So do later flows in the same suite. If the next message has no code, the variable is cleared. The code doesn’t exist until it arrives, so don’t write ${env:AUTOSANA_OTP_CODE} in the same flow’s instructions. The run fails before it starts because the variable is missing.

​
Rolling your own

If you’d rather return a magic link or OTP from your own server instead of leasing an inbox, you can do that with a script hook — see Hooks for returning a code via a cURL request.