--- title: "Test OTP and one-time login codes · Proxy Mail QA" description: "See one-time passcodes the second they arrive, copy them in one click and see how long they last: test OTP sign-in and verification codes without an inbox hunt." url: https://proxymail.qa/solve/otp-code-testing --- 1. [Home](https://proxymail.qa/) 2. [What we solve](https://proxymail.qa/solve) # Test OTP codes without hunting through an inbox One-time codes expire in minutes, arrive in bursts and look identical. Proxy Mail QA pulls the code out of each email and puts it next to a Copy button, so you can get back to the app you're testing. Updated 11 October 2026 ## Why OTP flows are fiddly to test - **Codes expire fast.** Five or ten minutes is common, so switching between a mailbox, a search box and your app eats into the window. - **Resends pile up.** After two or three resends, it’s hard to tell which code is the newest and which ones should already be dead. - **Emails hide the code.** It might be in the subject, in a big styled block, or in a sentence next to an order number and a support PIN. - **Several testers, one inbox.** Using a teammate’s code by mistake looks exactly like a bug in your app. ## How Proxy Mail QA helps 1. Create an address for the test, or one per tester. 2. Trigger the code in your app: sign-in, two-step verification, email change, checkout confirmation. 3. The code appears on the address’s row with a **Copy** button, usually within seconds. 4. If the email states how long the code lasts, a countdown shows the time left. Otherwise you see when it arrived. Each row always shows the newest email that contains a code or link, so a “Welcome” email arriving straight after “Your code is 482913” doesn’t hide the code. ## What to check in an OTP email - The code is easy to copy: no spaces or line breaks in the middle of it. - The stated lifetime matches what the app enforces. A code that says “10 minutes” shouldn’t stop working after 2. - Requesting a new code invalidates the old one, if that is your policy. - Wrong codes are rate-limited, and the error message says how many tries are left. - The email says what the code is for, so a user who didn’t request it knows to ignore it. - The code isn’t in the subject line if your security policy says it shouldn’t be visible on a lock screen. ## Automating this? Make it a test: waitForCode returns the newest code in one call, ready to type into the form. Pass the time of the step as since, so an older code is never picked. [Node.js client](https://proxymail.qa/docs/node) [Python](https://proxymail.qa/docs/python) [Set up your coding agent](https://proxymail.qa/docs/api#agent-setup) ## Try it on your next sign-up test Free plan, no credit card. Create an address and watch the code or link arrive. [Create a free account](https://app.proxymail.qa/?mode=signup&from=site-solve-otp-code-testing) ## Questions ### Which kinds of codes are recognised? Verification, login, one-time, security, access and activation codes, PINs, and coupon or promo codes. When an email contains several, the code it is talking about is chosen as the main one and the rest are listed in the inbox. ### Where does the countdown come from? From the email itself. If it says something like "expires in 10 minutes", you get a countdown that turns red near the end. If it doesn't say, we don't guess: you see how long ago the code arrived instead. ### What if the wrong code is picked? Open the inbox and choose "Use this instead" on the right one. The Accounts row switches to it, and the report helps improve detection. ### Do new codes appear without refreshing? Yes. Rows update live as mail arrives, and there is a Refresh button for when you want to be sure. ## Related guides - [Test sign-up and email verificationA fresh, private address for every sign-up test, with the verification link or code ready the moment it lands.](https://proxymail.qa/solve/email-verification-testing) - [Test magic links and passwordless sign-inSingle-use links that are never opened or prefetched on our side, so they still work when you click them.](https://proxymail.qa/solve/magic-link-testing) - [Test password reset emailsRequest, receive and use reset links, and keep the new password saved next to the test account.](https://proxymail.qa/solve/password-reset-testing) - [Stop sharing one Gmail inbox for QAPrivate, disposable addresses for every tester instead of one shared mailbox and a pile of plus-addresses.](https://proxymail.qa/solve/shared-test-inbox) - [Take QA notes by voice with Wispr FlowDictate what each test account is for, its state and what you found, straight into its notes, in seconds.](https://proxymail.qa/solve/voice-notes-wispr-flow) - [Verification link points to localhost:3000Why emails from staging link to localhost, how to fix it in Supabase, Firebase and other stacks, and how we flag it.](https://proxymail.qa/solve/localhost-links) - [Common Supabase sign-up and login problemsEmails that never arrive, links that expire or sign nobody in, and sign-ups that fail, with the fix for each.](https://proxymail.qa/solve/supabase-auth-problems) - [Common Firebase sign-up and login problemsMissing verification and reset emails, verified users who still look unverified, failing links and sign-up limits, with the fix for each.](https://proxymail.qa/solve/firebase-auth-problems) - [Sign-up and login problems in vibe-coded appsThe login bugs AI-built apps usually ship with: emails only you receive, links to the preview, missing pages, and what to ask the builder.](https://proxymail.qa/solve/vibe-coded-login-problems) - [Test sign-up emails in PlaywrightA complete Playwright test for sign-up codes and links, from a fresh inbox to the report on the pull request.](https://proxymail.qa/solve/playwright-email-tests) - [Test sign-up emails in CypressA complete Cypress test for sign-up links and codes, with the email waits running as Cypress tasks.](https://proxymail.qa/solve/cypress-email-tests) - [Test sign-up emails with pytestA complete pytest test for sign-up codes and links, with Playwright for Python or Selenium and a one-file helper.](https://proxymail.qa/solve/pytest-email-tests) - [Test coupon codes and welcome offersThe coupon with its discount, end date and arrival time, what checkout did with it, and a failure when an expired or reused one is accepted.](https://proxymail.qa/solve/coupon-code-testing) - [Test unsubscribe links and one-click unsubscribeThe unsubscribe headers and link checked on every marketing email, and a watch that flags any marketing after unsubscribing, with no time limit.](https://proxymail.qa/solve/unsubscribe-testing) - [Test that a welcome offer can't be claimed twiceVersions of one address that reach the same inbox, and a check that fails when the same person got the offer more than once.](https://proxymail.qa/solve/welcome-offer-abuse) [Built your app with an AI tool? Pick yours](https://proxymail.qa/built-with)