What is One-Time Password (OTP)?

A one-time password (OTP)is a short code — usually 4 to 8 digits — that is valid only once and only for a few minutes. It’s sent by email or SMS, or generated by an authenticator app, to confirm that whoever is signing up or logging in actually controls the account.

Where OTPs come from

• Emailed / SMS codes — the server generates a random code like 492013and sends it to the user’s inbox or phone. The user types it back to prove delivery.
• Authenticator apps (TOTP) — a time-based code derived from a shared secret, refreshing every 30 seconds. No message is sent; the app and server compute the same value independently.

OTPs and automated testing

Email OTPs are classic transactional emails — and a common wall for end-to-end tests, since the test has to read the code out of a real message before it can continue. A disposable inbox that detects and extracts the code turns that into a single API call, no body-parsing regex required. They serve the same goal as a magic link — verifying inbox control — just as a typed code rather than a clicked URL. See testing OTP and 2FA codes.