> Send one-time passwords and login codes by email that arrive in seconds, with data stored in India. Good practice for OTP emails, and how to send them with Vaartix.

Source: https://vaartix.com/use-cases/otp-emails

Use cases: [OTP emails](https://vaartix.com/use-cases/otp-emails) · [Password reset](https://vaartix.com/use-cases/password-reset) · [Order confirmations](https://vaartix.com/use-cases/order-confirmations)

# OTP and login code emails

Transactional email with Vaartix

A one-time code is only useful if it arrives while the person is still looking at your sign-in screen. Vaartix sends it straight away through Amazon SES in India, and tells you by webhook if it bounced.

## Why it matters

-   People wait for a code with your app open. A slow or missing code means a lost sign-in or a support ticket.
-   A code sent to a mistyped or dead address should be caught, so you can ask the person to check their address.
-   Codes are sensitive: they shouldn't be tracked, logged in plain text by third parties, or reused.

## Good practice

-   Put the code in the subject or first line, so it shows in the notification preview.
-   Keep it short: the code, how long it's valid for, and what to do if they didn't ask for it.
-   Make codes expire (5–10 minutes is common) and work once.
-   Send from a dedicated address on a verified domain, such as `login@yourdomain.in`.
-   Use an [idempotency key](https://vaartix.com/docs/sending/idempotency/) per request, so a retry doesn't send two different codes.
-   Never add open or click tracking to login codes. Vaartix tracks only emails you turn tracking on for (per domain or per email), so leave it off for these.
-   Listen for `email.bounced` [webhooks](https://vaartix.com/docs/webhooks/setup/) to tell the person their address didn't work.

## Send it with Vaartix

```
import { Vaartix } from 'vaartix';

const vaartix = new Vaartix(process.env.VAARTIX_API_KEY);

await vaartix.emails.send(
  {
    from: 'Acme <login@acme.in>',
    to: user.email,
    subject: `${code} is your Acme login code`,
    text: `Your code is ${code}. It expires in 10 minutes.\nIf you didn't ask for it, ignore this email.`,
  },
  { idempotencyKey: `login-${attemptId}` },
);
```

Also see the [quick start](https://vaartix.com/docs/quickstart/), [test mode](https://vaartix.com/docs/sending/test-mode/) to try bounces without real addresses, and [how to stay out of spam](https://vaartix.com/docs/guides/avoid-spam/).

**Vaartix is in private beta, and invite-only.** Every feature is free during the beta. Tell us what you send and we'll invite you as places open up.

[Request early access](https://vaartix.com/#early-access)