Email codes
Let approved visitors sign in with a one-time email code.
Setup
- Add an Email code identity provider.
- Assign it to an application.
- Add an allow policy for the required addresses or domains.
- Select Save Zero Trust.
Loclix manages email delivery. You do not need a mail account or provider credentials.
Visitor flow
The visitor enters an email address, then sees the code-entry page. An allowed address receives a code. A denied address receives no message and sees the same page.
Code limits
| Limit | Value |
|---|---|
| Code length | Eight digits |
| Expiry | 10 minutes |
| Verification attempts | Five |
| Successful uses | One |
| Request frequency | One per email and application per minute |
Rate-limited requests show the same form. Visitors must enter the code in the browser where they requested it. Saving application changes invalidates outstanding codes.
Delivery checks
Open Access activity to inspect policy decisions, queued messages, delivery outcomes, and verification attempts. If a code is marked sent but is missing, check the spam folder and recipient address. Contact support if it still does not arrive.
An email-delivery outage prevents new code sign-ins. Visitors already signed in keep their sessions until they expire.