Playwright 2FA OTP Testing: Ephemeral Inboxes Without Polling

The pain of testing email verification in modern CI/CD pipelines

End-to-end testing of user authentication flows in Playwright or Cypress frequently breaks when email verification or two-factor authentication (2FA) is introduced. Engineering teams traditionally resort to three fragile workarounds:

1. Disabling email verification in staging environments: This creates dangerous divergence between test and production code, leaving auth bugs undetected until release.

2. Querying a shared Gmail or IMAP mailbox: This introduces severe rate limits, concurrency collisions when multiple CI workers run in parallel, and slow polling loops.

3. Paying $49 to $300 per month for legacy email testing SaaS: Tools like MailSlurp enforce steep subscriptions and rely on HTTP polling that slows down CI runs.

SadaSend solves this with dedicated ephemeral test inboxes powered by Server-Sent Events (SSE). You can allocate a disposable inbox in sub-10ms, receive incoming verification emails instantly, and extract 6-digit OTP codes or magic links in under 150ms.

1. Setting up Playwright with the SadaSend SDK

Install the Playwright test runner and the SadaSend TypeScript SDK in your test environment:

npm install -D @playwright/test sadasend

In your test file (e.g. tests/auth.spec.ts), import test, expect, and initialize the SadaSend client:

2. Full Playwright 2FA OTP test specification

Here is the complete runnable Playwright test demonstrating zero-polling 2FA verification code extraction:

import { test, expect } from 'sadasend/playwright';

test.describe('Authentication with Two-Factor OTP', () => {
  test('registers new account and completes 2FA verification in <2s', async ({ page, ephemeralInbox }) => {
    // Step 1: Dedicated ephemeral inbox is provisioned automatically (<10ms allocation)
    console.log('Allocated ephemeral test mailbox:', ephemeralInbox.email);

    // Step 2: Navigate to registration form and submit email
    await page.goto('https://app.example.com/signup');
    await page.fill('input[name="email"]', ephemeralInbox.email);
    await page.fill('input[name="password"]', 'StrongPass2026!');
    await page.click('button[type="submit"]');

    // Assert that the UI transitioned to the 2FA challenge screen
    await expect(page.locator('text=Enter your 6-digit code')).toBeVisible();

    // Step 3: Wait for incoming OTP over live Server-Sent Events stream (<150ms push latency)
    // Zero polling lag: Resolves the exact millisecond the email arrives
    const otp = await ephemeralInbox.waitForOtp({ timeoutMs: 15000 });
    console.log(`Received 2FA verification OTP: ${otp}`);

    // Step 4: Fill OTP into the 2FA input and verify session
    await page.fill('input[name="otp"]', otp);
    await page.click('button[type="submit"]');

    // Step 5: Verify successful login
    await expect(page).toHaveURL(/.*dashboard/);
    await expect(page.locator('h1')).toContainText('Welcome to your Dashboard');

    // Step 6: Ephemeral inbox is destroyed automatically during test fixture teardown
  });
});

3. Testing Magic Links without OTPs

If your application authenticates via passwordless magic links rather than numeric OTPs, the testing API extracts the destination URL directly:

// Extract magic link URL directly from the incoming email
const magicLinkUrl = await ephemeralInbox.waitForMagicLink({ timeoutMs: 15000 });
expect(magicLinkUrl).toBeDefined();

// Navigate directly to the magic link in Playwright
await page.goto(magicLinkUrl);
await expect(page).toHaveURL(/.*dashboard/);

4. Running in parallel across GitHub Actions CI

Because each test run allocates an isolated inbox address (e.g. test_a8f9@test.sadasend.com), dozens of concurrent Playwright workers can execute simultaneously across GitHub Actions runners with zero mailbox collisions or shared state corruption.