One-time passcodes are everywhere: sign up for a service, log in from a new device, confirm an action, and a six-digit code lands in your email. A human glances at it and types it in. An automated flow, a signup script, an end-to-end test, or an AI agent connecting to a third-party service, can't glance at anything. It has to pull the code out of the mailbox programmatically, and that's a surprisingly fiddly job: the code arrives seconds after a trigger, it's buried in a templated email, and every sender formats it differently.
This post covers extracting verification codes from two angles: the webhook, and when a message arrives, fetch its body and parse the code out.
The flow is three steps. First, the webhook fires for every inbound message, so you filter down to the one that actually carries the code, usually by sender or by how recently it arrived relative to the action that triggered it. Second, you fetch that message's body with — the nylas otp commands in depth
— fetch a message body to parse
message.created webhook — the trigger that drives the pattern
SOCIAL SHARE CARD GENERATOR