Passwordless Login via Email based OTP
Overview
Passwordless login lets customers authenticate using a 6-digit one-time code sent to their email address instead of a password. At checkout, customers choose between Login, Register, and Guest checkout. Selecting Login or Register triggers the OTP flow — a code is sent to their inbox and on successful entry the session begins or the account is created.
OTP login is configured at shop level and is independent across shops. Enabling it for one shop has no effect on others.
Key Benefits
| Benefit | Detail |
|---|---|
| Reduced login friction | Customers authenticate without remembering a password, lowering drop-off at registration and login. |
| Recognition-first flow | SCAYLE determines whether the email is new or returning and shows on screen cues— no password needed on either path. |
| Shop-level control | OTP is enabled per shop via the SCAYLE Panel. Configuration values such as code lifetime and max attempts are set independently per shop. |
| Password fallback | Customers who have a password set can always switch to password login from the OTP screen. |
Understanding the Feature
Customers select their path at checkout via three tabs: Login, Register, or Guest checkout.
The screens and labels described above are provided out of the box by the SCAYLE web component. If you integrate directly with the Authentication API, you implement the equivalent states yourself.
On the Register tab, the customer enters the required fields and email address. A one-time code is sent to their inbox. On successful code entry, the account is created and the customer is logged in.
On the Login tab, the customer enters their email address. A one-time code is sent to their inbox. On successful code entry, the existing session is started.
If a customer enters the wrong code more times than the configured Max code attempts value, the code is invalidated and a Login with Password link is shown on the same screen. The forgot password flow is available for customers who need to set or recover a password.
If a code expires before it is entered, the screen shows a Code expired state with a Resend button. A new code can be requested within the limits set by Max code requests and Rate limit window. Each new code invalidates the previous one.
Passwordless (OTP) and Email Verification are mutually exclusive per shop. Enabling one automatically disables the other. The None option in the SCAYLE Panel disables both and uses password only.
Guest checkout is not affected by this feature. Guests proceed with email only and no OTP is required.
