---
title: "Generate one-time password"
method: POST
path: "/companies/{companyId}/connections/{connectionId}/bankFeeds/otp"
tags: ["Source accounts"]
---

# Generate one-time password

`POST /companies/{companyId}/connections/{connectionId}/bankFeeds/otp`

## Request

- Base URL: `https://api.codat.io`
- URL: `https://api.codat.io/companies/{companyId}/connections/{connectionId}/bankFeeds/otp`
- Auth: API key in header `Authorization`

The *Generate OTP* endpoint generates a one-time password (OTP) for a bank feed connection. The OTP is returned along with an expiry time, after which it will no longer be valid.

> **For Sage only**
>
> Only call this endpoint for connections to Sage. Calling it for other integrations will return an error.

## Response `200`

Success

- GenerateOtpResponse: Response containing a one-time password and its expiry time.
  - `otp` string, required: The one-time password.
  - `expiry` string, required: In Codat's data model, dates and times are represented using the <a class="external" href="https://en.wikipedia.org/wiki/ISO_8601" target="_blank">ISO 8601 standard</a>. Date and time fields are formatted as strings; for example: ``` 2020-10-08T22:40:50Z 2021-01-01T00:00:00 ``` When syncing data that contains `DateTime` fields from Codat, make sure you support the following cases when reading time information: - Coordinated Universal Time (UTC): `2021-11-15T06:00:00Z` - Unqualified local time: `2021-11-15T01:00:00` - UTC time offsets: `2021-11-15T01:00:00-05:00` > Time zones > > Not all dates from Codat will contain information about time zones. > Where it is not available from the underlying platform, Codat will return these as times local to the business whose data has been synced.

## Other responses

- `400`: The request made is not valid.
- `401`: Your API request was not properly authorized.
- `402`: An account limit has been exceeded. The type of limit is described in the error property: - You have exceeded the 50-company limit that applies to a Free plan. Delete any companies you no longer need and retry the request. - The requested sync schedule is not allowed. You requested an hourly sync schedule but this functionality is not included in the Free plan. - Your Free account is older than 365 days and has expired. Contact support@codat.io.
- `403`: You are using an outdated API key or a key not associated with that resource.
- `404`: One or more of the resources you referenced could not be found. This might be because your company or data connection id is wrong, or was already deleted.
- `429`: Too many requests were made in a given amount of time. Wait a short period and then try again.
- `500`: There is a problem with our server. Please try again later.
- `503`: The Codat API is temporarily offline for maintenance. Please try again later.

## Changes

- **2026-04-08** `661e33b0b5b3`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/codatio/apis/bank-feeds/changes/companies/:companyId/connections/:connectionId/bankFeeds/otp/post.md)

---

[API](https://skmtc.dev/codatio/apis/bank-feeds.md) - [All operations](https://skmtc.dev/codatio/apis/bank-feeds/llms.txt) - [OpenAPI document](https://skmtc.dev/codatio/apis/bank-feeds/revisions/ffea4a4680c5?raw)