[SandPod]

Documents email sign-in with a one-time code, added in serverpod/serverpod#5869. EmailOtpIdpBaseEndpoint handles both code and password sign-in for the same account, so the docs present it as the default email sign-in. Password-only sign-in (EmailIdpBaseEndpoint, EmailSignInWidget, EmailAuthController) moves to a section at the bottom of the setup, configuration, and customizing the UI pages. New projects use code sign-in, so the get started walkthrough is updated too. Only the unreleased docs/ tree is changed, since the feature ships in 4.1.

Changes

• Email setup: describes code and password sign-in for the same account, and exposes EmailOtpIdpBaseEndpoint. The custom email provider example lists sendOtpLoginVerificationCode last, as optional, with its fallback to sendRegistrationVerificationCode. The client section covers EmailOtpSignInWidget and allowPasswordSignIn. A new Switch from password-only sign-in section at the bottom has the steps for projects created before 4.1 (base class, regenerate, migration, widget override), and the warning about broken accountRequestId links when the sign-in callback falls back to the registration one.
• Email configuration: allowPasswordOnOtpRegistration, the 6-digit sign-in code and its custom generator (with a warning to match otpVerificationCodeConfig in the app), the development code bypass, and the new rate limits. The passwordRequirements tip names EmailOtpSignInWidget and EmailOtpAuthController. Registration code customization moves to a password-only section at the bottom.
• Customizing the UI: restructured around EmailOtpSignInWidget and EmailOtpAuthController. Covers their parameters, appearance, state management, screens, navigation, code sign-in with the optional password, password sign-in, password reset, resending codes, retrying after OtpLoginRejectedException, and email aliases being accepted by default. EmailSignInWidget and EmailAuthController move to a password-only section at the bottom, with a note that EmailOtpSignInWidget should be used instead.
• Admin operations: deleteExpiredOtpLoginRequests and deleteOtpLoginAttempts.
• UI components: the emailOtpSignInWidget override, with a pointer to the switch section for password-only projects. The localization section adds EmailWithOtpSignInTexts and VerificationCodeTexts.
• Get started: the test steps match a new project (Send code, the Login code for … log line, Create account), with a note linking projects created before 4.1 to the switch section.
• Auth setup and legacy auth migration: the endpoint example extends EmailOtpIdpBaseEndpoint, the provider list mentions code sign-in, and the migration guide covers both endpoint base classes.

To check

• The screenshot on the get started page (/img/authentication/sign-in-widget-device.png) likely still shows the password flow.
• deleteOtpLoginAttempts(email: ...) without olderThan only deletes entries outside the 15 minute window, so it does not lift the rate limit as its doc comment says. The docs example passes olderThan: Duration.zero.
• Fully translating the code sign-in widget needs both EmailSignInTexts and EmailWithOtpSignInTexts. Consolidating them is tracked as a breaking change in Consolidate the email sign-in text objects into one serverpod#5896.
• The site build has not been run locally.

🤖 Generated with Claude Code