Check the six-digit one-time password (OTP) we emailed for a forgotten password, a password change, or a self-service signup. For forgot_password, a successful check also returns a bearer token for that user; use it to call Reset password. For rs_signup, it marks the signup's email address as verified.

Prerequisites — an OTP sent to the email address: by Resend email OTP (forgot_password), Change password (change_password) or Initiate signup (rs_signup).

Authentication — Public (no token). The OTP is identified by email and type; only the most recent unexpired code is checked. A code expires after 5 minutes and is invalidated after 3 wrong attempts.

Rate limit — 10 requests per minute, counted per client IP address. All rate-limited endpoints share the same per-IP total. Throttled responses carry X-RateLimit-Limit and X-RateLimit-Remaining; a 429 adds Retry-After and X-RateLimit-Reset and returns {"message": "Too Many Attempts."}.