Is there an issue with Test user static OTP codes in non-production projects? All of the sudden I am getting real OTP messages when attempting to authenticate with test user accounts

Issue Identified Your project likely has the

production

tag enabled, which automatically disables static OTP codes for test users . Check Project Settings 1. Go to Project Settings 2. Look under General > Environment Settings 3. Check if the

production

tag is applied to your project Resolution Options If you need static OTP codes for testing: 1. Remove the

production

tag from your project settings 2. Re-enable Static OTP codes under Project Settings > Test User section Alternatively, use generated OTP codes instead:

// Generate OTP for test user via Management API
const resp = await descopeClient.management.user.generateOTPForTestUser("email", "<mailto:test@example.com|test@example.com>");

• Static OTP codes are automatically disabled in production-tagged projects for security • This setting is excluded from production environments by design • Consider using the generateOTPForTestUser API method for more secure testing Project Settings | Descope Documentation Test User Management Overview | Descope Documentation Test Users in Backend | Descope Documentation

This is not the case and I haven't made any changes to this project. It's still in Non-production mode and does not have any tags assigned to it

Immediate Steps to Check 1. Verify Static OTP is still enabled in Project Settings under Test User section 2. Check if the regex pattern for static OTP codes matches your test user identifiers 3. Confirm your users are still marked as test users in the Users table Possible Causes Since you haven't made changes, this could be: • A recent platform update affecting static OTP behavior • Test user flags were accidentally removed from your users • Static OTP setting was inadvertently disabled Quick Verification

# Check if users are still test users via Management API
GET /v1/mgmt/user?loginId=your-test-user@example.com
# Look for "test": true in the response

Temporary Workaround Use the generateOTPForTestUser API to get real OTP codes for testing:

const resp = await descopeClient.management.user.generateOTPForTestUser("email", "<mailto:test@example.com|test@example.com>");
console.log("Generated OTP:", resp.data.code);

The documentation doesn't cover this specific scenario. I'd recommend checking your Project Settings first, then contacting Descope support if the static OTP setting appears correct but isn't working.

my test user is active and tagged as a test user. When I test the regex for the test username and phone number they both pass. Still getting actual OTP sms codes. Was not a few hours ago

Platform Issue Likely Since your configuration is correct (test user active, regex passing, non-production project) but static OTP stopped working "a few hours ago," this appears to be a platform-side issue. Immediate Actions 1. Try toggling the Static OTP setting off and back on in Project Settings 2. Check if other projects in your company are experiencing the same issue 3. Look at your project's audit logs for any unexpected changes Temporary Solution Use the Management API to generate real OTP codes for testing:

const resp = await descopeClient.management.user.generateOTPForTestUser("sms", "+1234567890");
// Use the returned code for verification

Report the Issue This sounds like a platform bug that needs immediate attention. Contact Descope support with: • Your project ID • Exact time when static OTP stopped working • Screenshots of your current Static OTP configuration • Example test user details that should match the regex The timing of this issue (working hours ago, suddenly stopped) strongly suggests a platform-side change rather than a configuration problem on your end.