Offload time-sensitive 6-digit email passcodes, 2FA login challenges, and password recovery tokens to our dedicated low-latency REST gateway. Engineered strictly for user-initiated transactional security events.
import { CoreAuthClient } from '@coreauth/sdk';
const auth = new CoreAuthClient(process.env.COREAUTH_API_KEY);
// Dispatched strictly on explicit user form submission
const session = await auth.otp.dispatch({
recipient: 'user@client-app.com',
event: 'user_login_2fa',
digits: 6,
ttlSeconds: 300,
clientIp: req.ip
});
console.log(session.requestId); // "req_01J9X8K2P7M"from coreauth import CoreAuth
client = CoreAuth(api_key="ca_live_98a7bc65e412")
# Dispatch time-based 6-digit verification code
response = client.otp.send(
email="user@client-app.com",
purpose="account_registration",
ttl_seconds=300
)
print(response["status"]) # "dispatched"client := coreauth.NewClient(os.Getenv("COREAUTH_KEY"))
res, err := client.OTP.Dispatch(ctx, &coreauth.OTPRequest{
Email: "user@client-app.com",
Purpose: "login_verification",
TTLSeconds: 300,
})
// res.Status == "dispatched" | res.ExpiresIn == 300let client = CoreAuth::from_env()?;
let receipt = client.otp()
.recipient("user@client-app.com")
.purpose(Purpose::RegistrationVerify)
.ttl_seconds(300)
.send()
.await?;curl -X POST https://api.coreauth-sys.com/v2/otp/dispatch \
-H "Authorization: Bearer ca_live_98a7bc65" \
-H "Content-Type: application/json" \
-d '{
"email": "user@client-app.com",
"purpose": "login_verification",
"ttl_seconds": 300
}'Every verification message passes through four cryptographic and anti-abuse stages in under 25 milliseconds before reaching the recipient's inbox.
User submits their email on an authentication form. Client backend calls /v2/otp/dispatch with IP and timestamp context.
Edge gateway verifies the recipient is not on the global hard-bounce suppression list and enforces the 3-request/15m sliding limit.
Token is salted and hashed in ephemeral Redis cache. Outbound MIME payload is signed with 2048-bit DKIM and strict SPF alignment.
Delivered over TLS 1.3 SMTP relays with real-time delivery, bounce, and FBL telemetry streamed back via signed webhooks.
CoreAuth restricts message templates to verified security schemas. Marketing content, promotional links, and bulk broadcasts are blocked at the API parser level.
{
"template_id": "tmpl_registration_otp_v2",
"trigger": "explicit_user_signup_submit",
"recipient": "developer@example-client.com",
"client_context": {
"ip_address": "103.21.244.12",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
"opt_in_timestamp": "2026-10-21T09:30:10Z"
},
"variables": {
"otp_code": "849201",
"expiry_minutes": 10
}
}{
"template_id": "tmpl_session_2fa_challenge",
"trigger": "authenticated_login_challenge",
"recipient": "developer@example-client.com",
"client_context": {
"ip_address": "103.21.244.12",
"location": "Kolkata, IN",
"session_id": "sess_99481a8c"
},
"variables": {
"otp_code": "849201",
"expiry_minutes": 5
}
}{
"template_id": "tmpl_password_recovery_token",
"trigger": "user_forgot_password_request",
"recipient": "developer@example-client.com",
"variables": {
"reset_token_id": "tok_reset_849201",
"expiry_minutes": 15
}
}You recently submitted your email address to verify a new account registration. Enter the following single-use verification code to complete setup:
A sign-in attempt requires two-factor verification from IP 103.21.244.12. Enter this one-time passcode to authorize your session:
We received a request to reset the password associated with this email address. Use the one-time recovery code below within 15 minutes:
103.21.244.12
Expires in: 10 minutes
This is an automated, user-initiated security message dispatched via CoreAuth Systems. If you did not request this code, no action is required.
Our gateway enforces strict programmatic guardrails at every step to maintain clean sender scores across major inbox providers.
Prevents OTP flooding by limiting individual email addresses to a maximum of 3 verification requests per 15-minute sliding window.
Hard bounces and feedback loop (FBL) complaints immediately add the recipient to a global suppression table, blocking future API calls.
Verification codes are salted and hashed in ephemeral Redis clusters with strict TTL auto-eviction; plaintext codes are never logged.
Every outbound message is signed with 2048-bit DKIM keys and strict SPF return-path alignment to guarantee authentic headers.
CoreAuth refuses unauthenticated traffic. Every connected sender domain must pass automated DNS verification checks before production keys are activated.
| Protocol | Record Type | Required Host / Value Alignment | Enforcement Status |
|---|---|---|---|
| SPF | TXT | v=spf1 include:spf.coreauth-sys.com ~all | Mandatory |
| DKIM (2048-Bit) | TXT / CNAME | ca1._domainkey.clientdomain.com → RSA Public Key | Mandatory |
| DMARC Policy | TXT (_dmarc) | v=DMARC1; p=quarantine; rua=mailto:dmarc@coreauth-sys.com | Aligned |
| Return-Path | CNAME | bounces.clientdomain.com → feedback.coreauth-sys.com | Auto-Handled |
Start integrating for free in our developer sandbox. Scale as your user base grows.
Ideal for local development, staging environments, and integration testing.
For production web and mobile applications requiring instant OTP throughput.
High-throughput bursts, dedicated IP pools, and custom compliance SLAs.
CoreAuth operates exclusively as an identity verification conduit. We comply fully with the Digital Personal Data Protection Act (DPDP Act, India), CAN-SPAM, and GDPR frameworks for transactional data processing.
Our infrastructure team monitors support and abuse queues 24/7. For urgent deliverability inquiries or to report an unauthorized verification request, submit a ticket or email our desks directly.
Your inquiry () has been assigned Reference ID . Our on-call engineering team will respond to your email address within 4 business hours.
A single-use 6-digit verification code has been queued for . Enter the OTP below:
Effective Date: October 1, 2026 | Entity: CoreAuth Systems Pvt. Ltd.
1. Scope of Transactional Processing: CoreAuth Systems ("CoreAuth", "we", "our") operates strictly as a data processor providing user-initiated identity verification and transactional notification infrastructure. We collect recipient email addresses, IP metadata, and session timestamps solely to deliver requested One-Time Passwords (OTPs), 2FA challenges, and password recovery tokens.
2. Strict Zero-Spam & Opt-In Requirement: CoreAuth prohibits the transmission of unsolicited commercial email (UCE), marketing newsletters, cold outreach, or promotional broadcasts. Every API dispatch call must correspond directly to an explicit, real-time action initiated by the end-user (such as clicking "Send Verification Code" on a registration form).
3. Automated Suppression & Revocation: We maintain automated webhook listeners for hard bounces (5xx SMTP codes) and ISP feedback loop (FBL) spam reports. Any email address generating a hard bounce or complaint is immediately placed on a global suppression list and blocked from subsequent API dispatches.
4. Data Retention & Ephemeral Hashing: Verification passcodes are cryptographically hashed using SHA-256 and stored in ephemeral memory for a maximum TTL of 600 seconds. Delivery telemetry logs are retained for 30 days exclusively for security auditing and abuse prevention, after which they are permanently purged.
5. Grievance Officer & Abuse Contact: In accordance with the Information Technology Act and the Digital Personal Data Protection Act (DPDP Act), any inquiries regarding data privacy or reports of unauthorized message dispatch may be directed to abuse@coreauth-sys.com or support@coreauth-sys.com.