# Passwordless errors
## Common failures
- "Wrong email or verification code" / expired code: OTPs expire (configurable, minutes). Users who request twice then enter the FIRST code fail; only the latest code is valid. Tell users to use the newest message.
- Magic link opened on a different device/browser: the link is bound to the browser session that requested it (PKCE verifier in storage). Opening the email on the phone when the login started on desktop fails. Either complete on the same device or use OTP codes which are device-independent.
- Rate limits: passwordless endpoints are throttled per phone/email. "Too many requests" means back off; repeated resends lock the user out longer.
- Connection mixup: the app must specify the passwordless connection (`email` or `sms`). If the tenant has both database and passwordless connections and the app does not pin one, users land on the wrong flow.
## Setup checklist
1. Authentication > Passwordless: enable Email or SMS, configure the provider (Auth0's built-in email is for testing; production needs your own provider).
2. Application > Connections: enable the passwordless connection on the app.
3. Code path: `passwordlessStart` then verify with the code; link path: configure the link lifetime and the redirect.
## Debugging
- Tenant logs show passwordless start/verify events with the failure reason (expired, wrong code, throttled).
- Test with a real inbox/phone; mocked flows hide the newest-code-wins behavior.
## Checklist
- Users told to use the latest code.
- Same-device requirement communicated for magic links.