How it works
- Your application or test generates a shared secret during MFA setup.
- You pass the shared secret to the Mailosaur API.
- The API returns the current 6-digit TOTP code.
- Your test enters the code into the application.
For the full endpoint details, request format, and response schema, see Retrieve an OTP code in the API reference.
When to use this approach
Use the API approach when:
- You have access to the shared secret in your test code (for example, from a seeded test account)
- You want to avoid creating and managing devices
- You need a single code for a one-off verification
Use a device instead when:
- You need a persistent authenticator that multiple team members can access in the Dashboard
- You do not have programmatic access to the shared secret