What is the difference between an email verification code and an authenticator code?
An email code is sent to an inbox. An authenticator code is worked out from a secret and the current time, usually with TOTP.
The two can look identical, but an agent needs a different way to get each one.
For an email code, the service creates and sends a message. The workflow needs access to the right inbox, then has to find the new message and take its code. For a TOTP code, the authenticator and the service share a secret set up in advance; the authenticator works out the current code from that secret and the time. RFC 6238 describes the time-based algorithm.
A simple way to tell which one you need
- Read the sign-in prompt. If it says a code was emailed, look in the inbox for the address used on the account.
- If it asks for a code from an authenticator app, use the authenticator enrolled for that account. The QR code shown during setup holds what is needed to configure the authenticator; keep it private.
- Use the newest matching code or message, and enter it before the service stops accepting it. If it fails, check that the account, the authenticator and the device clock are right before starting over.
- Keep codes and secrets out of logs and shared transcripts. An agent that can use a credential is acting with the access you gave it.
For example, a six-digit code arriving in a message is an email code. A changing six-digit number shown in an authenticator app is usually TOTP. Six digits alone do not tell you which kind you have.
NIST's digital identity guidance explains how authenticators are managed and why their secrets need protecting. TOTP is not phishing-resistant: a code can still be typed into a fake site. Use the stronger option a service offers where you can.
With ActAs, email codes arrive in the agent's own inbox, and authenticator codes come from ActAs for only the logins you grant. The guide to 2FA codes shows both.