3SO Flow Navigation
Passwordless Login
Instead of a stored password, 3SO can authenticate a user with a one-time code delivered to a channel they already control — email or SMS — reusing the same OTP delivery infrastructure as its MFA system.
Not a separate OAuth grant type
Passwordless login is an authentication method at the identity provider's login screen, not an OAuth 2.0 grant type. Once the user verifies the one-time code, 3SO issues an authorization code through the standard Authorization Code flow like any other login.
Email OTP
A time-limited one-time code is sent to the user’s verified email address via the configured email provider (Resend) and entered on the login screen.
POST /oauth2/passwordless/start
Content-Type: application/json
{ "channel": "email", "identifier": "[email protected]" }
// -> 200 OK, code emailed to the userSMS OTP
A one-time code is delivered by SMS through the configured Twilio integration for phone-verified accounts.
POST /oauth2/passwordless/start
Content-Type: application/json
{ "channel": "sms", "identifier": "+3670XXXXXXX" }
// -> 200 OK, code sent via SMSRecovery Codes
An offline fallback when email or SMS delivery isn't available
3SO also issues single-use recovery codes users can generate and store offline, so account access isn't entirely dependent on a live email or SMS channel.