Use cases: OTP emails · Password reset · Order confirmations

OTP and login code emails

Transactional email with Vaartix

Why it matters

• People wait for a code with your app open. A slow or missing code means a lost sign-in or a support ticket.
• A code sent to a mistyped or dead address should be caught, so you can ask the person to check their address.
• Codes are sensitive: they shouldn't be tracked, logged in plain text by third parties, or reused.

Good practice

• Put the code in the subject or first line, so it shows in the notification preview.
• Keep it short: the code, how long it's valid for, and what to do if they didn't ask for it.
• Make codes expire (5–10 minutes is common) and work once.
• Send from a dedicated address on a verified domain, such as [email protected].
• Use an idempotency key per request, so a retry doesn't send two different codes.
• Never add open or click tracking to login codes. Vaartix tracks only emails you turn tracking on for (per domain or per email), so leave it off for these.
• Listen for email.bounced webhooks to tell the person their address didn't work.

Send it with Vaartix

import { Vaartix } from 'vaartix';

const vaartix = new Vaartix(process.env.VAARTIX_API_KEY);

await vaartix.emails.send(
  {
    from: 'Acme <[email protected]>',
    to: user.email,
    subject: `${code} is your Acme login code`,
    text: `Your code is ${code}. It expires in 10 minutes.\nIf you didn't ask for it, ignore this email.`,
  },
  { idempotencyKey: `login-${attemptId}` },
);

Also see the quick start, test mode to try bounces without real addresses, and how to stay out of spam.