Separate Sign-Up Email OTP Verification From Password Reset Link Flow in Auth0

When configuring the Email Attribute Verification Method to One-Time Password (OTP), Auth0 automatically enforces a unified OTP verification across both the sign-up and self-service password reset flows. However, there might be a security or operational need to separate Sign-Up Email OTP Verification from Password Reset Link Flow. Administrators can separate the sign-up email OTP verification from the password reset link flow by configuring the database connection attributes and leveraging Auth0 Forms and Actions.

• Auth0
• One-Time Password (OTP)
• Email Verification

After configuring the Email Attribute Verification Method to One-Time Password (OTP) on a Database Connection, Auth0 globally binds that verification method to all default authentication flows. As a result, the self-service password reset system is forced to switch from its secure, link-based verification system to the One-Time Password.

How is the sign-up email OTP verification separated from the password reset link flow?

Keep sign-up verification in session using OTP while restoring password reset to a secure magic link by configuring the database connection attributes to Email Verification Link and leveraging Auth0 Forms and Actions to run registration OTP logic.

1. Go to Authentication > Database > Attributes in the Auth0 Dashboard.
2. Locate Email and select Configure next to its verification methods.
3. Set the verification method to Link.
4. Disable Verify email on sign up.
5. Create a form using the Email OTP verification with Auth0 Email Provider template.
   
6. Create an Action to render the form using the following code.

   exports.onExecutePostLogin = async (event, api) => {
     if (event.user.email_verified) {
       return; 
     }
     api.prompt.render('form_id');
   };
   
   exports.onContinuePostLogin = async (event, api) => {
   };