Source: https://cli.nylas.com/guides/extract-otp-codes-from-email

English

# Extract OTP Codes from Email — Skip the Inbox

Stop switching to your inbox every time a 2FA code arrives. nylas otp get scans recent emails for verification codes and copies the result to your clipboard in under a second. Works across all major email providers — no browser required.

Written by [Nick Barraclough](https://cli.nylas.com/authors/nick-barraclough) Product Manager

Reviewed by [Qasim Muhammad](https://cli.nylas.com/authors/qasim-muhammad)

Updated July 9, 2026

> **TL;DR:** Run [`nylas otp get`](https://cli.nylas.com/docs/commands/otp-get) to pull the latest OTP from your inbox to your clipboard. Use `--raw` for scripting, [`nylas otp watch`](https://cli.nylas.com/docs/commands/otp-watch) to poll for incoming codes. No inbox tab needed.

## Why are OTP codes hard to extract from email?

OTP codes are hard to extract from email because every verification interrupts your workflow with 30–60 seconds of context switching — opening your inbox, scanning for the message, locating the 6-digit code inside a styled template, typing it into the login prompt, and switching back to your original task.

For developers running integration tests or end-to-end flows, the problem is worse. Extracting codes programmatically means writing custom email polling logic for each provider — Gmail API, Microsoft Graph, IMAP idle — before the actual test can even begin. According to the [FIDO Alliance Online Authentication Barometer](https://fidoalliance.org/online-authentication-barometer/), users frequently abandon signups when verification is slow, and brittle OTP extraction code is one of the top causes of flaky E2E test suites.

The Nylas CLI eliminates both problems with a single command: [`nylas otp get`](https://cli.nylas.com/docs/commands/otp-get) scans recent messages across Gmail, Outlook, Yahoo, iCloud, and any IMAP server, extracts the code, and copies it to your clipboard in under 1 second.

## How do I get the latest OTP code?

The `nylas otp get` command scans recent emails, extracts the most recent verification code, and copies it to your clipboard — typically completing in under 1 second. Email one-time codes are usually 6 digits — the length specified for TOTP in [RFC 6238](https://datatracker.ietf.org/doc/html/rfc6238) — and expire within 5–10 minutes.

Running the command with no arguments fetches the latest code from your default account. The CLI searches the most recent messages for common OTP patterns (numeric codes embedded in verification-style emails) and returns the match.

```bash
nylas otp get
```

```text
✓ OTP found

  Code:    847291
  From:    noreply@github.com
  Subject: Your GitHub verification code
  Copied to clipboard
```

For scripting and CI/CD pipelines — where clipboard side effects are unwanted — the `--raw` flag outputs only the bare code. This makes it easy to capture the value in a shell variable.

```bash
nylas otp get --raw
```

```text
847291
```

To keep the code visible in your terminal output without copying it to the clipboard, use the `--no-copy` flag. This is useful when you want to read the code on screen and type it manually.

```bash
nylas otp get --no-copy
```

## How do I watch for incoming OTP codes?

The [`nylas otp watch`](https://cli.nylas.com/docs/commands/otp-watch) command polls your inbox continuously and prints each new OTP code as it arrives. This is useful when you trigger an action that sends a verification email and need to capture the code without knowing exactly when it will land. The default polling interval is 5 seconds, which means most codes appear within 5–10 seconds of delivery.

Start watching by running the command with no arguments. The CLI keeps polling until you press Ctrl+C. Each code is timestamped and printed alongside the sender address.

```bash
nylas otp watch
```

```text
Watching for OTP codes... (Ctrl+C to stop)

  [14:23:05] 847291  — noreply@github.com
  [14:31:18] 193047  — security@google.com
```

The `--interval` flag sets the polling frequency in seconds. A shorter interval catches codes faster but sends more API requests. For most use cases, 5–10 seconds balances speed and efficiency.

```bash
nylas otp watch --interval 5
```

Combine `--no-copy` with a custom interval when running in a terminal where clipboard access isn't available, such as a remote SSH session or a Docker container.

```bash
nylas otp watch --no-copy --interval 10
```

## How do I list configured email accounts?

The `nylas otp list` command shows every email account connected to the Nylas CLI, along with its provider type. Developers who work with multiple accounts — for example, a personal Gmail and a corporate Outlook tenant — can use this to confirm which accounts are available before fetching codes. The CLI supports 6 provider types in a single configuration: Gmail, Outlook, Exchange, Yahoo, iCloud, and IMAP.

Each row in the output maps an email address to its detected provider. This makes it straightforward to identify which account to target when calling `nylas otp get`.

```bash
nylas otp list
```

```text
  ACCOUNT                        PROVIDER
  user@gmail.com                 Gmail
  work@company.com               Outlook
  personal@icloud.com            iCloud
```

To fetch a code from a specific account instead of the default, pass the email address as an argument. This avoids ambiguity when multiple accounts have recent OTP emails.

```bash
nylas otp get user@gmail.com
```

## How do I use OTP codes in scripts?

The `--raw` flag turns `nylas otp get` into a composable building block for shell scripts, CI/CD pipelines, and end-to-end test harnesses. Because it outputs only the bare code with no formatting, the result can be captured directly in a variable with standard command substitution.

The script below demonstrates a full OTP verification flow: it triggers a password-reset email via an API call, waits 3 seconds for delivery, extracts the code, and submits it. In production CI environments, this pattern replaces 20–50 lines of custom provider-specific polling logic.

```bash
#!/usr/bin/env bash
set -euo pipefail

EMAIL="user@example.com"
API_BASE="https://app.example.com/api"

# Trigger the OTP email
curl -s -X POST "$API_BASE/auth/send-otp" \
  -H "Content-Type: application/json" \
  -d "{"email": "$EMAIL"}"

# Wait for delivery, then grab the code
sleep 3
CODE=$(nylas otp get --raw)

echo "Got code: $CODE"

# Submit the code
curl -s -X POST "$API_BASE/auth/verify-otp" \
  -H "Content-Type: application/json" \
  -d "{"email": "$EMAIL", "code": "$CODE"}"

echo "Verified."
```

In CI/CD environments like GitHub Actions, store the Nylas API key as a repository secret. The example below shows a 2-step workflow: the first step configures authentication, and the second runs the OTP test script. This approach keeps credentials out of source control entirely.

```yaml
# GitHub Actions example
- name: Authenticate Nylas CLI
  run: nylas auth config --api-key ${{ secrets.NYLAS_API_KEY }}

- name: Run OTP flow test
  run: ./scripts/test-otp-flow.sh
```

The CLI reads the `NYLAS_API_KEY` environment variable automatically, so you can skip the [`nylas auth config`](https://cli.nylas.com/docs/commands/auth-config) step in ephemeral CI environments. This is the recommended approach for containers and serverless runners where the filesystem doesn't persist between jobs.

```bash
# Set env var — CLI picks it up automatically
export NYLAS_API_KEY=your_key
CODE=$(nylas otp get --raw)
```

## What if nylas otp get returns no code?

When `nylas otp get` returns nothing or errors, the cause is setup, not the email. The most common is `E001`, no default grant, which means no mailbox is selected yet. A missing API key shows `E006` instead. Both name the command that fixes them.

```bash
# No default mailbox selected (E001)
$ nylas otp get
✗ Error: No default grant set
  Code: E001

  Suggestion:
  • Run 'nylas auth list' to see grants, then 'nylas auth switch <grant-id-or-email>' to set a default
```

Run `nylas auth switch <grant-id-or-email>` to pick a mailbox, or `nylas auth config` if the key itself is missing, then re-run the watcher. Setup errors surface before any inbox is read.

## Next steps

- [Build a signup & verification bot](https://cli.nylas.com/guides/signup-otp-bot-agent-account) — an agent that signs up for services and reads its own codes on an agent account
- [E2E email testing with Playwright](https://cli.nylas.com/guides/e2e-email-testing) — combine OTP extraction with full end-to-end test flows
- [Email as identity for AI agents](https://cli.nylas.com/guides/email-as-identity-for-ai-agents) — authenticate AI workflows via email-based verification
- [PowerShell email in CI/CD](https://cli.nylas.com/guides/powershell-email-cicd) — Windows-native automation for email-dependent pipelines
- [Getting started with Nylas CLI](https://cli.nylas.com/guides/getting-started) — connect your first account in under 5 minutes
- [Password reset emails: choosing an API](https://cli.nylas.com/guides/password-reset-email-api) — latency, deliverability, and end-to-end testing for reset flows
- [Command reference](https://cli.nylas.com/docs/commands) — every flag, subcommand, and example
- [RFC 6238 -- TOTP: Time-Based One-Time Password](https://datatracker.ietf.org/doc/html/rfc6238) — the spec for the time-windowed codes you're extracting from email

## Related hubs

- [Email agents](https://cli.nylas.com/ai-answers/email-agents.md)
- [Calendar agents](https://cli.nylas.com/ai-answers/calendar-agents.md)
- [Scheduling and availability agents](https://cli.nylas.com/ai-answers/scheduling-agents.md)
- [Contacts agents](https://cli.nylas.com/ai-answers/contacts-agents.md)
- [Notetaker and meeting agents](https://cli.nylas.com/ai-answers/notetaker-agents.md)
- [MCP agents](https://cli.nylas.com/ai-answers/mcp-agents.md)
- [Agent accounts](https://cli.nylas.com/ai-answers/agent-accounts.md)
- [Framework and language email agents](https://cli.nylas.com/ai-answers/framework-email-agents.md)
- [Email and calendar API comparisons](https://cli.nylas.com/ai-answers/ai-agent-email-api-comparisons.md)
- [Email integration and automation recipes](https://cli.nylas.com/ai-answers/email-integration-recipes.md)
- [Agent email workflows](https://cli.nylas.com/ai-answers/agent-email-workflows.md)
- [Security for email and calendar agents](https://cli.nylas.com/ai-answers/security-for-email-agents.md)
- [Operations runbooks for agents](https://cli.nylas.com/ai-answers/operations-for-email-calendar-agents.md)

## Try Nylas CLI

Install the CLI with `curl -fsSL https://cli.nylas.com/install.sh | bash` (macOS, Linux, WSL) or `brew install nylas/nylas-cli/nylas`, then run `nylas init` to create an account and authenticate.

**Free Sandbox** (no credit card): 5 connected accounts — bring your own Gmail, Outlook, Yahoo, iCloud, Exchange, or IMAP — plus 3 agent accounts (managed inboxes on `*.nylas.email`). Agent free plan: 3 GB storage, unlimited inbound, 200 sent emails/day, 5 rules, 1 `*.nylas.email` subdomain, and unlimited custom domains. Production is uncapped and requires a credit card: https://www.nylas.com/pricing/