One-time passcode email template

Make it fit the send.

• Name the action and the thing acted on as input: the action completes the sentence “Confirm it's you to”, the resource is the path, project or team the code applies to, and one sentence says exactly what happens when the code is entered.
• The code is the hero and there is no button, because the OTP only works in the session that asked. A muted link cancels the request, so someone who did not ask for it can stop it without entering the code.
• State the expiry in the expiry notice and pass the request details as a list of label and value. The template never reads the clock. Your application generates the code, binds it to the account, action and session, limits attempts and enforces one use.
• For a sign-in that pairs a magic link with a fallback code, open Login code or Linear login code instead. It is written for Plinth, a fictional platform for deploying web apps: replace its mark and the shield pictogram, and edit the passcode email in the AI email editor.

Data this template expects.

{{account}}

The address the code was sent to, for example maya@halyard.example. Shown in the footer so the reader knows which account asked.

{{action}}

What the code confirms, phrased to follow “Confirm it's you to”, for example “reveal a production secret”.

{{actionDetail}}

One sentence naming exactly what happens when the code is entered. Keep it specific and true to what your application does.

{{cancelUrl}}

A link that cancels the pending request without the code. It must work outside the session that asked.

{{code}}

The one-time code as a string, for example “481726”. Preserve leading zeroes and never reuse the preview value for real requests.

{{expiryNotice}}

For example: “Works once, for the next 5 minutes.” Derive this copy from the actual server-side expiry policy.

{{requestDetails}}

A list of { label, value } objects, for example { "label": "Device", "value": "Firefox 144 on Ubuntu 24.04" }. Use recorded context, not guessed location or device identity.

{{resource}}

The thing acted on, as your product names it: a path, a project or a team, for example halyard-labs/storefront-web/production/DATABASE_URL.

{{securityUrl}}

Your sessions or account-security page, for the reader who did not ask for the code.