---
schema_version: "1"
id: 252af0ceb218e54f2ff197922bacdafe8ca018bddb0cd988289887d7718b2ad6
title: One-Time Password (OTP) Behavior
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/identity_otps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.identity_otps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c16f6ebf1af54bc019ca5c463cb1fb5c53cb6d3973e7daf5af1bc98f42d72f6b
description: Salesforce sends one-time passwords (OTPs) to verify identity for multiple use cases, such as passwordless login, device activation, multi-factor authentication (MFA) for Experience Cloud sites, and more. Learn about expiration time, limits, and generation behavior for OTPs for different use cases.
products:
  - Security
release: "264"
---
# One-Time Password (OTP) Behavior

Salesforce sends one-time passwords (OTPs) to verify identity for multiple use cases, such as passwordless login, device activation, multi-factor authentication (MFA) for Experience Cloud sites, and more. Learn about expiration time, limits, and generation behavior for OTPs for different use cases.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:25%">
        <col style="width:25%">
        <col style="width:25%">
        <col style="width:25%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105156e38">OTP Use Case</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105156e41">Expiration Time</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105156e44">Limits</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d105156e47">OTP Generation For Each New Request</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Used with the <a href="https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_UserManagement.htm#apex_System_UserManagement_initRegisterVerificationMethod" target="_blank"><code>UserManagement.initRegisterVerificationMethod</code></a> Apex
            method. Sent via SMS to verify identity when a user registers a phone number. For
            Experience Cloud site users only.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated only if the previous OTP has expired.</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Sent via SMS to verify identity when a user changes their phone number in their
            personal information settings. </td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated only if the previous OTP has expired.</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Sent via SMS to verify identity when a user adds their phone number if prompted
            after login. For internal users only. </td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">15 Minutes</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>1 failed attempt</li>

              <li>10 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly.</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Used with the <a href="https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_UserManagement.htm#apex_System_UserManagement_initRegisterVerificationMethod" target="_blank"><code>UserManagement.initRegisterVerificationMethod</code></a> Apex
            method. Sent via email to verify identity when a user registers an email address. For
            Experience Cloud site users only.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly.</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Sent via email to verify identity when a user changes their email address in
            their personal information settings.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Verify identity via email or SMS for <a href="https://help.salesforce.com/s/articleView?id=xcloud.device_activation_orgs.htm&amp;language=en_US" target="_blank">device activation</a>.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 ">Complete <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_direct_login_user_perm.htm&amp;release=264.0.0&amp;type=5" title="Salesforce doesn’t require multi-factor authentication (MFA) for external users but you can certainly include this class of users in your MFA implementation. To enable MFA for external users who log in directly to your company’s Experience Cloud sites, employee communities, or other types of community portals, apply the Multi-Factor Authentication for User Interface Logins user permission. You can also use the MFA user permission to enable MFA for specific internal users. When MFA is turned on, users logging in directly with their username and password must also provide an identity verification method such as an authenticator app or security key.">Enable MFA for External Experience Cloud Site Users (or Specific Internal Users)</a> by using email or SMS. These MFA methods aren't supported
            for internal users.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.external_identity_passwordless_login_use_cases.htm&amp;language=en_US" target="_blank">Passwordless login and passwordless
              registration</a> via email or SMS. For Experience Cloud sites only.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">15 Minutes</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>10 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated with each new request</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_customers_overview.htm&amp;language=en_US" target="_blank">Headless self-registration for off-platform
              apps</a>, using a phone number.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_customers_overview.htm&amp;language=en_US" target="_blank">Headless self-registration for off-platform
              apps</a>, using an email address.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">24 Hours</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated if the previous OTP has expired or if the user entered the previous OTP
            incorrectly</td>

        </tr>
        <tr class="">
          <td data-label="OTP Use Case" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e38 "><a href="https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_customers_overview.htm&amp;language=en_US" target="_blank">Headless passwordless login for off-platform
              apps</a>, using either an email address or phone number.</td>

          <td data-label="Expiration Time" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e41 ">15 Minutes</td>

          <td data-label="Limits" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e44 ">
            <ul>
              <li>3 failed attempts</li>

              <li>5 new OTP requests per hour</li>

            </ul>
          </td>

          <td data-label="OTP Generation For Each New Request" class="slds-cell-wrap" style="vertical-align:top;" headers="d105156e47 ">Generated with each new request</td>

        </tr>
      </tbody>
    </table>