> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autosana.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Testing One-time Passwords (OTP)

> Let the agent receive and enter a real email or SMS login code using Autosana built-in hooks.

Many apps gate sign-in behind a one-time password — an email or SMS code you have to receive and type back in. Autosana ships **built-in hooks** that handle this for you: each run leases a real inbox (or phone number), the agent enters that address during the flow, the incoming code is captured, and the agent reads it and types it in — no shared test account, no hard-coded code.

## How it works

A built-in hook runs as a **flow setup hook**, before the agent starts. It:

1. Leases a fresh, single-use address for that run and exposes it to the flow as an environment variable.
2. Receives the provider's email (or SMS) at that address and stores the code.
3. Lets the agent read the code back and enter it to complete sign-in.

Each address is minted per run and never reused, so parallel runs never collide.

## Built-in hooks

Add these from the **Hook Library** — on the **Hooks** page, click **Add from Library**.

| Hook                    | Provides                                                  | Status      |
| ----------------------- | --------------------------------------------------------- | ----------- |
| **Lease email address** | `AUTOSANA_EMAIL_ADDRESS`                                  | Available   |
| **Lease phone number**  | `AUTOSANA_PHONE_NUMBER`, `AUTOSANA_PHONE_NUMBER_NATIONAL` | Coming soon |

<Note>
  **Lease phone number** appears in the library as **Coming soon** and can't be added yet while we complete carrier (Twilio) approval. Email OTP is fully available today.
</Note>

## Email OTP

### 1. Add the hook to your organization

On the **Hooks** page, click **Add from Library**, then **Add** on **Lease email address**. This adds it once for your organization; you can then attach it to any flow.

### 2. Attach it as a flow setup hook

Open the flow, expand **Advanced → Setup Hooks**, and add **Lease email address**. Setup hooks run in order before the flow begins.

<Info>
  Email OTP is a **flow setup** hook — it provisions the inbox for the whole flow. It isn't offered in teardown or suite slots.
</Info>

### 3. Reference the address in your instructions

Once attached, the hook exposes `AUTOSANA_EMAIL_ADDRESS` for the run. Reference it in your flow steps like any other variable:

```text theme={null}
1. Tap "Continue with email"
2. Sign in with email: $AUTOSANA_EMAIL_ADDRESS
3. Check the inbox for a one-time code
4. Enter the code

Test passes if you reach the app home screen.
```

The agent enters the leased address, waits for the code to arrive at that inbox, reads it, and types it in. You'll see the setup hook and its output at the top of the run's **Agent Actions**:

```text theme={null}
Setup Hooks
  Lease email address — Leased email address <run-inbox>@… for this run (AUTOSANA_EMAIL_ADDRESS).
```

<Tip>
  Keep the sign-in steps in the app's own vocabulary ("Continue with email", "Enter the code") and let the agent handle the rest — you don't need to script polling the inbox or reading the code.
</Tip>

## SMS OTP (coming soon)

**Lease phone number** works the same way for phone-based 2FA: it leases a real test phone number for the run and exposes `AUTOSANA_PHONE_NUMBER` (E.164) and `AUTOSANA_PHONE_NUMBER_NATIONAL` (without the country code) for the agent to receive an SMS login code. It's shown in the library as **Coming soon** until carrier approval is complete.

## Rolling your own

If you'd rather return a magic link or OTP from your own server instead of leasing an inbox, you can do that with a script hook — see [Hooks](/hooks) for returning a code via a cURL request.