# Request a code (https://docs.loybox.com.ar/en/api-reference/autenticacion/pedir-codigo)



<Endpoint method="POST" path="/v1/auth/otp/request" auth="none" />

Emails a 6-digit code so the end user can sign in.

If the email has no Loybox account, the account is created when
[verifying the code](https://docs.loybox.com.ar/api-reference/autenticacion/verificar-codigo), not here.

<Callout title="It always answers 200">
  It answers `200` even if the email does not exist. That is **deliberate**: if it
  answered differently, anyone could use this endpoint to find out which emails are
  registered.

  In your UI this means that after requesting the code you always show the same
  message ("we sent a code to your email"), with no way to know whether the account
  existed.
</Callout>

## Headers
<Fields>
  <Field name="X-Commerce-Id" type="integer" location="header" required="true">
    Id of the commerce integrating the API. Every response is scoped to this
    commerce.
  </Field>
</Fields>

It carries no `Authorization`: this is the endpoint the session starts with.

## Body
<Fields>
  <Field name="email" type="string" required="true">
    The user's email. It has to be a valid email format.
  </Field>
</Fields>

## Example
```bash
curl -X POST https://loybox-public-api-752998171300.southamerica-west1.run.app/v1/auth/otp/request \
  -H "X-Commerce-Id: 87" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ana@example.com"
  }'
```

```json
// 200 OK
{
  "message": "Código enviado"
}
```

<Callout type="info">
  The `message` comes back from the API in Spanish. It is text for the developer,
  not for showing to the user (see [Errors](https://docs.loybox.com.ar/api-reference/errores)).
</Callout>

## Rules of the code
* It expires in **10 minutes**.
* It allows **5 attempts**.
* Requesting a new code **invalidates the previous one**.

## Errors
| Code  | When                                                            |
| ----- | --------------------------------------------------------------- |
| `422` | The `X-Commerce-Id` header is missing, or the email is invalid. |