---
title: "Request a one-time sign-in code by email"
method: POST
path: "/api/auth/otp-request"
tags: ["Agent Sessions"]
---

# Request a one-time sign-in code by email

`POST /api/auth/otp-request`

## Request

- Base URL: `https://flint.network`
- URL: `https://flint.network/api/auth/otp-request`
- Auth: none required

The agent-native front door: an MCP agent (or the SPA) calls this first with an inbox address, reads the code WorkOS Magic Auth sends to that inbox, then calls POST /api/auth/otp-verify. Rate limited to 5 requests per email and 20 per IP per 10 minutes. Never echoes the code.

## Request body

- OtpRequestRequest
  - `email` string, email, required

## Response `200`

Code sent.

- OtpRequestResponse
  - `ok` boolean
  - `email` string, email
  - `delivery` 'email'
  - `expires_in_seconds` integer

## Other responses

- `400`: invalid_email.
- `429`: otp_rate_limited, with reason "ip", "email", or "provider".
- `502`: auth_provider_error.
- `503`: auth_not_configured: WORKOS_API_KEY or WORKOS_CLIENT_ID is not set.

---

[API](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api.md) · [All operations](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/revisions/eb5052b7b5dc?raw)