> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-an-external-scan/handling-captcha-email-mobile-otps.md).

# Handling Captcha/Email/Mobile OTPs

Use the recorder's **Auth Actions** menu when a login requires an OTP, magic link, authenticator code, or supported image CAPTCHA.

## Choose the Correct Identity

Before recording, select the email identity assigned to the account in Browser Session Manager. Later scans poll only that exact inbox for email OTPs and magic links.

Do not invent plus-address suffixes or use another identity unless it is explicitly listed for the workspace. Choose **None** when the account uses a customer-managed inbox or a long-lived session that Pentest Copilot should not poll.

## Auth Actions

| Challenge                         | Action                                                                                           |
| --------------------------------- | ------------------------------------------------------------------------------------------------ |
| Email code                        | Select **Email OTP**, then click the destination input when prompted.                            |
| Email sign-in link                | Select **Email Magic Link**; the recorder polls the selected inbox and opens the extracted link. |
| SMS code                          | Select **Phone OTP** and follow the recorder status instructions.                                |
| Authenticator app                 | Select **TOTP**, provide the Base32 secret, then click the OTP input when prompted.              |
| Image containing text             | Select **OCR Captcha**, then select the image and destination input in the requested order.      |
| reCAPTCHA, hCaptcha, or Turnstile | Wait for the configured solver. If it does not complete, follow the failure guidance below.      |

Wait for the recorder status to return to ready before continuing.

## TOTP

Provide the Base32 secret shown during authenticator enrollment, not a currently displayed six-digit code. The secret is stored with the browser session so later authentication replay can generate a current code.

Treat exported browser-session data as sensitive because it can contain the TOTP secret.

## OCR CAPTCHA

1. Select **Auth Actions -> OCR Captcha**.
2. When prompted, click the image containing the characters.
3. When prompted, click the input where the answer belongs.
4. Wait for the recorder to solve and fill the value.

Do not manually fill the same input while the OCR action is running. If the answer is wrong, request a new CAPTCHA and repeat the action.

## When a Challenge Fails

* Confirm the correct email identity or phone workflow was selected before recording.
* Use **Refresh** after the target dynamically adds the OTP or CAPTCHA input so it becomes highlighted.
* Confirm the code or link belongs to the current login attempt and has not expired.
* Retry a fresh CAPTCHA rather than repeatedly submitting an old challenge.
* If the target blocks automated solving, complete the challenge manually when authorized and note that replay may still require support.
* Re-record the session if authentication actions or verification pages were captured incorrectly.

For engagement-specific identity provisioning or targets that allowlist particular email domains or phone numbers, contact Bugbase support before recording.