[Due for payment 2026-07-30] [$250] Update all Magic Code front-end references in New Expensify

[MelvinBot]

Problem

We want to update all Magic Code front-end references throughout New Expensify (NewDot). "Magic code" copy appears across authentication, onboarding, verification gates, and per-action confirmation flows, and needs to be updated consistently everywhere it is surfaced to the user.

Scope

Update every user-facing front-end reference to the magic code across the flows below. This is a front-end-only pass over NewDot copy/strings (including src/languages/*.ts), not a behavior change.

Authentication

• Sign-in (home) — user enters emailed magic code to log in
• SSO vs. magic code choice (home) — user chooses magic code instead of SSO; triggers code send
• Email link auto-login (v/:accountID/:validateCode) — validates silently, no input required

Onboarding

• Work email validation (onboarding/work-email-validation)
• Private domain validation (onboarding/private-domain)
• Missing personal details (missing-personal-details/:cardID/confirm-magic-code)

One-time validation gates

Account-level (shown once when an unverified account tries to take an action):

• Add a delegate/copilot (settings/security/delegate/verify-account)
• Enable 2FA (settings/security/two-factor-auth/verify-account)
• Add or refresh company card feed (workspaces/:policyID/company-cards/verify-account)
• Add bank account to wallet (add-bank-account/verify-account)
• Add bank account for reimbursements (bank-account/verify-account)
• Set up invoicing bank account (workspaces/:policyID/invoices/verify-account)
• Add workspace domain (workspaces/add-domain/verify-account)
• Select country for international deposit account (settings/wallet/add-bank-account/select-country/verify-account)
• Request travel access (travel/verify-account)
• Create a money request (/:transactionID/:reportID/verify-account)
• Confirm a money request (/confirmation/:transactionID/:reportID/verify-account)
• Perform action on a report (r/:reportID/verify-account)
• Perform action on an expense report (e/:reportID/verify-account)
• Perform action from search (search/verify-account, search/view/:reportID/verify-account, search/r/:reportID/verify-account)
• Enable wallet (DynamicVerifyAccountPage.tsx)

Per-contact-method (shown once per email/phone):

• Verify a newly added contact method (settings/profile/contact-methods/:contactMethod/details)
• Connect Expensify Card feed to workspace (workspaces/:policyID/expensify-card/:fundID/verify-work-email)
• Connect company card feed to workspace (workspaces/:policyID/company-cards/:feed/verify-work-email)

Magic code required each time

• Add or update a delegate/copilot (settings/security/delegate/:login/role/:role/confirm/magic-code, settings/security/delegate/:login/confirm-role/:newRole)
• Update sensitive personal details (settings/profile/private-personal-details/confirm)
• Set default contact method (settings/profile/contact-methods/:contactMethod/set-default/confirm)
• Add a new contact method (settings/profile/contact-methods/new/confirm-magic-code)
• Merge accounts (settings/security/merge-accounts/:login/magic-code)
• Enable Biometric MFA (modal)
• Issue a new Expensify Card (workspaces/:policyID/expensify-card/issue-new/confirm-magic-code)
• View card PAN/CVV (settings/wallet/card/:cardID/confirm-magic-code)
• View Travel Invoicing Card CVV (settings/wallet/travel-cvv/verify-account)
• Report card lost or damaged (settings/wallet/card/:cardID/report-card-lost-or-damaged/:reason/confirm-magic-code)
• Report virtual card fraud (settings/wallet/card/:cardID/report-virtual-fraud/verify-account)

Error messages

Universal (all flows that accept code input):

• Empty field: "Please enter your magic code"
• Wrong code: "Incorrect or invalid magic code. Please try again or request a new code."
• Server errors: displayed as-is from the API response — no client-side copy

Sign-in only (additional 2FA / recovery code errors):

• Empty 2FA field: "Please enter your two-factor authentication code"
• Wrong 2FA code: "Incorrect two-factor authentication code. Please try again."
• Empty recovery code field: "Please enter your recovery code"
• Wrong recovery code: "Incorrect recovery code. Please try again."

Merge accounts only:

• Unrecognized server error: "Something went wrong. Please try again later."

Notes

• This is the App/front-end companion to the broader tracking effort (internal tracking issue: Expensify/Expensify#657264).
• When editing src/languages/*.ts, preserve per-locale typography and TS string delimiters.

Issue Owner

Current Issue Owner: @Pujan92

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022079958817340988049
• Upwork Job ID: 2079958817340988049
• Last Price Increase: 2026-07-22

[laurenreidexpensify]

@MelvinBot write a PR to update all front end references to "magic" and replace with "security"

[laurenreidexpensify]

Price discussed with @Pujan92 here - https://expensify.slack.com/archives/C02NK2DQWUX/p1783592913593199 $250 for all review changes

[MelvinBot]

🤖 Draft PR created: #96181

I updated every user-facing "Magic code" reference to "Security code" across NewDot (sign-in, onboarding, one-time verification gates, per-action confirmations, and error messages).

Scope — one file: src/languages/en.ts (26 string values).

Per the i18n workflow, en.ts is the single source of truth and all other locale files are auto-generated — their headers literally say "This file was automatically generated." So I edited only the English source; the Generate static translations workflow runs automatically on any PR touching en.ts and will regenerate de/es/fr/it/ja/nl/pl/pt-BR/zh-hans with the localized equivalent of "security code" (e.g. código de seguridad, Sicherheitscode, code de sécurité).

I deliberately left these unchanged because they aren't user-facing and changing them would be a behavior change (out of scope per the issue's "not a behavior change" note):

• Translation keys (magicCode, enterMagicCode, incorrectMagicCode, …)
• Routes (.../confirm-magic-code, .../merge-accounts/:login/magic-code)
• Component/asset/identifier names (MagicCodeInput, magic-code.svg)

Please mark the PR as "Ready for review" once you've filled in the Tests/QA sections and are happy with it.

[Pujan92]

@MelvinBot merge main and fix conflicts in pr #96181

[melvin-bot]

I can't run change requests for your access level. I can investigate, or file an issue in Expensify/Expensify instead.

---

Failed after 0s · 0 tools used · view debug log

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022079958817340988049

[melvin-bot]

Current assignee @NikkiWines is eligible for the choreEngineerContributorManagement assigner, not assigning anyone new.