OTP verification

One-time codes, sent and checked in two calls.

Your system asks Connect for a code; Connect generates it, sends it through your own registered OTP template, and tells you whether the code your customer typed is right.

Ask for OTP API overview

How it works

Your template, your sender, and only a hash of each code.

Switched on for an account on request. Codes go out as ordinary sends of your account, so they appear in your delivery reports and usage like everything else.

Request a code
Send the customer’s mobile number. Connect generates the code, fills it into your OTP template and sends it.
Your customer types it
You get a verification ID back, with when the code expires and when a new one may be asked for.
Check it
Send the ID and the code. Connect answers verified or not — and why not: incorrect, expired, too many attempts or already used.

Protection

Built against abuse from the first code.

SMS pumping — requests for codes nobody enters — costs money and harms sender reputation. Connect limits it at every level.

Stored only as a hash

A code is kept as a keyed hash and shown as dots in your send history. A newer code to the same number retires the older one.

Growing waits

Each further code to the same number waits longer, and every number has an hourly and a daily cap.

Per-customer limits

Pass the end user’s IP address and codes are limited per address as well — the usual signature of an automated attack.

Automatic pause

When many codes go out and too few are verified, codes are paused for the account, you are told, and they stay paused until your account manager resumes them.

Ahead of the queue

Codes can use capacity held back from bulk sends, so a customer waiting for a code does not wait behind a campaign.

Your settings

Choose the code length (4 to 8 digits), how long a code lasts (1 to 15 minutes) and how many attempts it allows (up to 10). Follow codes sent, delivered and verified.

The API

Two endpoints. A webhook if you want one.

Authenticate with an API key from your account. Every code’s progress is also reported to your webhook as an otp.updated event.

Send a code

curl -X POST https://api.connect.erptools.in/api/v1/otp/send \
  -H "Authorization: Bearer cnk_…" \
  -H "Content-Type: application/json" \
  -d '{ "mobile": "98XXXXXXXX", "purpose": "login", "end_user_ip": "203.0.113.7" }'

# Example response
# { "verification_id": "…", "expires_at": "…", "resend_after": 30, "max_attempts": 5 }

Check a code

curl -X POST https://api.connect.erptools.in/api/v1/otp/verify \
  -H "Authorization: Bearer cnk_…" \
  -H "Content-Type: application/json" \
  -d '{ "verification_id": "…", "code": "482913" }'

# Example response
# { "verified": true, "attempts_left": 4 }

Verify customers with the account you already have.

Existing customers can log in now. New to Connect? Tell us what you need to send and we will set you up.

Talk to us Log in