Sign in with a code

Enter your email and the server mints a 6-digit code, stores only a salted hash of it in the embedded B+tree (data/otp.db) with a 10-minute TTL and a 5-attempt cap, then hands the code to a pluggable delivery seam. The framework ships no email client, so by default the code is logged (see the auth docs); an app wires a real sender. Works with JavaScript disabled.