What is one-time code?

A one-time code, also called a one-time password (OTP), is a short secret, typically six digits, sent to a channel the customer controls, email or SMS, and accepted once, within a few minutes. Typing it back proves the person at the keyboard can read that inbox or phone. In a chat widget it is the usual way a visitor becomes verified.

It matters because it is the cheapest proof of control that customers already understand, and because its parameters are the whole of its security: how many digits, how long the code lives, how many wrong guesses are allowed, how soon a new one can be requested, and whether the code is stored as a hash or in the clear. Six digits with five attempts and a ten-minute life gives a guesser one chance in 200,000 per code; six digits with unlimited attempts gives them certainty.

Where it runs out: a code proves control of a channel, not identity. Anyone who can read the inbox, a colleague, a family member or an attacker with the email password, passes. Email codes also arrive late or in spam, so the flow needs a resend button with a cooldown and plain error messages. And a code in chat verifies the visitor to the product, not to the model: a language model cannot confirm that a code was entered, so a tool that should only run after verification must be gated by the application, not by an instruction to the agent.