Email OTP
In previewVerify by email, on a real email network.
Email verification sends a one-time code to an email address — no phone number required, and the channel reaches anyone with an inbox. Bird sends it on the same infrastructure that carries transactional email at scale, from a shared sender or your own verified domain, and checks it by recipient.
import { BirdClient } from "@messagebird/sdk";
const bird = new BirdClient({ apiKey: process.env.BIRD_API_KEY! });
// Send the code, then check it by recipient.
await bird.verify.verifications.create({
to: { email_address: "ada@example.com" },
}).safe();
const { data } = await bird.verify.verifications.check({
to: { email_address: "ada@example.com" },
code: userInput,
}).safe();The verification channel that needs no phone number.
Email is a first-class channel on the Bird Verify API: post a verification with an email address and we send the code from the shared Authifly sender, otp@verify.authifly.com, or your own verified domain. It's country-independent, so it works the same everywhere, and it rides the same network Bird runs for transactional email at scale.
What you get on an email verification.
Built in, on every send.
- 01
Addressed by email.
Pass a single email address. No phone number, no country — email is the one channel that reaches anyone with an inbox.
- 02
Shared or your own domain.
Send from the shared Authifly sender (otp@verify.authifly.com) out of the box, or override to a domain you've already verified for sending.
- 03
A ready-made OTP email.
The code lands in a clean, mobile-ready default template: the code up front, an expiry note, and a reminder never to share it. Nothing to design before you ship.
- 04
On the Bird email network.
Your codes ride the same delivery infrastructure as your product's transactional email: signed, routed, and monitored.
- 05
Server-generated, hashed codes.
A 6-digit code by default (4–10 configurable), generated with a cryptographic random source and stored only as an HMAC.
- 06
Check by recipient.
Confirm the code by the email address it went to — no verification id to keep, and re-posting the create resends within the session.
Send to an address, check by the same address.
An email verification is the same two calls as any other channel — only the recipient shape changes from a phone number to an email address.
await bird.verify.verifications.create({
to: { email_address: "ada@example.com" },
}).safe();
const { data } = await bird.verify.verifications.check({
to: { email_address: "ada@example.com" },
code: userInput,
}).safe();
// data.result is true or false; data.reason elaborates ("expired", "already_verified", …)Email OTP FAQ
When should I verify by email instead of SMS?+
Can I send from my own domain?+
Do you check the suppression list before sending an OTP?+
How are the codes stored?+
Who do my users see the code from?+
The rest of the Verify platform
One API, one set of keys. Explore the other capabilities.
Your verification codes on the network that runs your email.
Email is one channel of Bird Verify: SMS and WhatsApp ship with it, and voice is rolling out — all on the same two endpoints.