Using the .NET .http file to test native auth with email/OTP in Entra External ID (EEID)

Rory Braybrook

2 min read

·

Aug 31, 2026

--

Listen

Share

All the .http posts are here.

Read this post first to get the background.

For this example, you need a user flow for email/OTP.

The .http file below is a continuation of the one in the post above.

This flow is more complicated because an OTP is sent to the email address, so you have to run the script in two parts:

• Run the sign-in and challenge requests
• Get the OTP code sent to the email address
• Update the .http file for the OTP via @otpCode = some-code and save it
• Run the token request

### Native Auth OTP

@otpClientId = 61...9b
@otpUsername = user@gmail.com

### Start sign in (OTP)
# @name otpStartSignUp
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/initiate
Content-Type: application/x-www-form-urlencoded
Host: {{tenant}}.ciamlogin.com

client_id={{otpClientId}}&challenge_type=oob redirect&username={{otpUsername}}

###

### Challenge (OTP) - triggers the email one-time passcode to be sent
# @name otpChallenge
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/challenge
Content-Type: application/x-www-form-urlencoded

client_id={{otpClientId}}&challenge_type=oob redirect&continuation_token=
  {{otpStartSignUp.response.body.$.continuation_token}}

###

### <<< MANUAL STEP >>>
### Check email for the one-time passcode, then paste it below before running 
### the Token request
@otpCode = 29184860

### Token (OTP)
# @name otpToken
POST https://{{tenant}}.ciamlogin.com/{{tenantDomain}}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={{otpClientId}}&continuation_token={{otpChallenge.response.body.$.
  continuation_token}}&grant_type=oob&scope=openid offline_access
  &oob={{otpCode}}

###

Note: The body lines are wrapped here for readability only.

An example of the email is:

Account verification code
To access eeid-tenant's apps and resources, please use the code below for 
account verification. The code will only work for 30 minutes.
Account verification code:
29184860

The result is:

{     
  "token_type": "Bearer",
  "scope": "openid profile email 00000003-0000-0000-c000-00...00/User.Read",
  "expires_in": 4539,
  "ext_expires_in": 4539,
  "access_token": "ey...7w",
  "refresh_token": "1.A...v5M",
  "id_token": "ey...mA"
}

A full set of JWTs is returned.

Refer to “How to run a .http file”.

All good!