How to send OTP emails from Node.js with an email API

import { randomInt, createHash } from "node:crypto";

const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
await db.otp.create({
  email,
  hash: createHash("sha256").update(code).digest("hex"),
  expiresAt: new Date(Date.now() + 10 * 60_000),
});

const res = await fetch("https://api.sendpository.com/v1/emails", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SENDPOSITORY_API_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": `otp-${email}-${code}`,
  },
  body: JSON.stringify({
    from: "Acme <security@mail.yourdomain.com>",
    to: [email],
    subject: `${code} is your Acme sign-in code`,
    html: `<p>Your code is <strong style="font-size:24px">${code}</strong>.</p><p>It expires in 10 minutes. If you didn't try to sign in, ignore this email.</p>`,
    text: `Your code is ${code}. It expires in 10 minutes.`,
    tags: { type: "otp" },
  }),
});
if (!res.ok) throw new Error((await res.json()).error.type);

import crypto from "node:crypto";
import express from "express";
import { Sendpository, SendpositoryError } from "sendpository";

const app = express().use(express.json());
const sendpository = new Sendpository(process.env.SENDPOSITORY_API_KEY);

const TTL_MS = 10 * 60_000;
const MAX_ATTEMPTS = 5;
const hash = (code: string) => crypto.createHash("sha256").update(code).digest();

app.post("/auth/otp", async (req, res) => {
  const email = String(req.body.email ?? "").trim().toLowerCase();

  // One code a minute per address, so the form can't flood an inbox.
  if (await db.otp.sentWithin(email, 60_000)) return res.status(429).json({ error: "wait" });

  const id = crypto.randomUUID();
  const code = String(crypto.randomInt(0, 1_000_000)).padStart(6, "0");
  await db.otp.insert({ id, email, hash: hash(code), attempts: 0, expiresAt: Date.now() + TTL_MS });

  try {
    await sendpository.emails.send(
      {
        from: "Acme <security@mail.acme.com>",
        to: [email],
        subject: `${code} is your Acme sign-in code`,
        html: `<p>Your code is <strong>${code}</strong>. It expires in 10 minutes.</p>`,
        text: `Your code is ${code}. It expires in 10 minutes.`,
        tags: { type: "otp" },
      },
      { idempotencyKey: `otp-${id}` },
    );
  } catch (err) {
    // A suppressed address can't receive mail - tell the user to use another one.
    if (err instanceof SendpositoryError && err.type === "suppressed_recipient") {
      return res.status(422).json({ error: "undeliverable_address" });
    }
    throw err;
  }
  res.json({ id }); // the client sends this back with the code
});

app.post("/auth/otp/verify", async (req, res) => {
  const row = await db.otp.find(String(req.body.id));
  if (!row || row.expiresAt < Date.now() || row.attempts >= MAX_ATTEMPTS) {
    return res.status(400).json({ error: "expired" });
  }
  await db.otp.incrementAttempts(row.id);

  const ok = crypto.timingSafeEqual(row.hash, hash(String(req.body.code ?? "")));
  if (!ok) return res.status(400).json({ error: "wrong_code" });

  await db.otp.delete(row.id); // single use
  res.json({ ok: true, session: await createSession(row.email) });
});