Verify phone numbers

The OTP endpoints generate a code, send it by SMS and check what the user enters. You never have to store codes yourself.

1. Send a codeCopy Anchor Link

curl https://api.appstractone.com/v1/otp/send \
  -H "Authorization: Bearer $APPSTRACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "0241234567",
    "from": "MYSHOP",
    "length": 6,
    "expiresInMinutes": 5,
    "message": "Your MyShop code is {{code}}. It expires in {{minutes}} minutes."
  }'

Sending a new code to a number replaces any code still pending for it. The response includes an id; keep it to verify the code.

2. Verify the codeCopy Anchor Link

curl https://api.appstractone.com/v1/otp/verify \
  -H "Authorization: Bearer $APPSTRACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "id": "otp_01M6MJSBXRZS9JGB57380Y48E5", "code": "102028" }'

You can send to instead of id to check the latest code sent to that number.

LimitsCopy Anchor Link

• After 5 wrong attempts, the code is locked and verify returns 429 with otp_locked. Send a new code.
• Each number can receive a limited number of codes per hour. Beyond it, send returns 429 with otp_rate_limited.

PrivacyCopy Anchor Link

Codes are stored as one-way hashes, and the code is removed from the stored message text once it has been sent.