TESTHEON Practice Lab
AdvancedPW-MFA-00540 minutesPlaywright

Reject invalid OTP attempts predictably

Invalid OTP input is deliberately bounded to three attempts so a practice assertion does not require uncontrolled retry behavior.

  • authentication
  • api
  • assertions

Objective

What to automate

Submit an incorrect OTP three times for one valid challenge.

Preconditions and test data

Preconditions

  • Use a fresh isolated Practice Lab browser context.
  • Open the fixture identified by FX-AUTH-001.

Test data

  • invalid OTP: 000000
  • attempts: 3
  • expected code: MFA_ATTEMPTS_EXHAUSTED

Expected result

The first failures report MFA_CODE_INVALID and the third reports MFA_ATTEMPTS_EXHAUSTED.

Open practice pageRead related guide

Progressive hints

Hint 1

Reuse one valid, unexpired challenge ID for all three submissions.

Hint 2

Assert the attemptsRemaining detail after the first failure.

Hint 3

Expect the final named exhaustion code instead of continuing retries.

I’ve tried it — show solution
  1. Reuse one valid, unexpired challenge ID for all three submissions.
  2. Assert the attemptsRemaining detail after the first failure.
  3. Expect the final named exhaustion code instead of continuing retries.

The deliberately failing starter is in tests/mfa.spec.ts inside the TypeScript starter ZIP.