OTP Testing

The problem

One-time passwords are everywhere. Most apps gate sign-in behind a code sent over email or SMS. Testing these flows has always been painful because you need a real inbox or phone number to receive the code, a way to read it, and a way to enter it back into the app, all within the flow.

Most teams work around this with shared test accounts, hard-coded bypass codes, or skipping OTP testing entirely. Shared accounts break under parallel runs. Bypass codes do not test the real flow. Skipping it means your most critical authentication path ships untested.

Autosana now handles OTP testing end to end with built-in hooks that lease a real inbox or phone number for every run.

How it works

Autosana ships two built-in hooks available from the Hook Library: Lease email address and Lease phone number. Each hook executes as a flow setup hook before the agent starts.

The process is straightforward:

1. The hook leases a real email address or phone number for that run alone
2. The address or number is exposed as an environment variable
3. The agent enters it during the sign-in flow
4. The incoming code is captured when it arrives
5. The agent reads the code and types it in to complete authentication

No two runs ever hold the same address at the same time. A run only reads codes that arrive while it holds the lease, so parallel runs cannot interfere with each other. Email addresses are minted fresh for every run and never reused. Phone numbers are drawn from a shared pool and released when the run ends.

Email OTP

Add Lease email address from the Hook Library on the Hooks page. Attach it as a setup hook to a flow or a suite. When attached to a suite, each member flow receives its own inbox, including when the suite runs members in parallel.

The hook exposes AUTOSANA_EMAIL_ADDRESS for the run. Reference it in your flow instructions:

1. Tap "Continue with email"
2. Sign in with email: $AUTOSANA_EMAIL_ADDRESS
3. Check the inbox for a one-time code
4. Enter the code

Test passes if you reach the app home screen.

The agent enters the leased address, waits for the code to arrive, reads it, and types it in. You do not need to script inbox polling or code extraction. Write the steps the way you would describe them to a person.

SMS OTP

Lease phone number works the same way. Add it from the Hook Library and attach it as a setup hook. A suite attachment leases a separate number for each member flow, so parallel runs never share a number.

The hook provides the number in two formats:

Reference the appropriate format in your flow:

1. Tap "Continue with phone"
2. Enter phone number: $AUTOSANA_PHONE_NUMBER_NATIONAL
3. Tap "Send code"
4. Enter the code that arrives by SMS
5. Tap "Verify"

The number is held for the entire run and released when it ends. Phone numbers come from a shared pool, so runs that need one can queue behind each other at high concurrency.

Custom OTP handling

If your app uses a custom authentication provider or you prefer to return a magic link or OTP from your own server, you can do that with a script hook instead of the built-in lease hooks. Create a hook that calls your backend endpoint and returns the code. Full details are in the Hooks documentation.