canonical: https://jentic.com/apis/otp.dev/getotp

# Otp GetOTP API

GetOTP is an OTP (One-Time Password) delivery and verification service supporting multiple channels including SMS, Viber, Voice (flash call or TTS), and Telegram. The API enables developers to send verification codes, validate user-submitted OTP codes, and manage OTP workflows for two-factor authentication, account verification, and passwordless login. It provides channel selection, delivery tracking, retry logic, and verification status management for secure identity verification flows.

## For AI agents

Send and verify OTP codes via SMS, Viber, Voice, and Telegram: deliver verification codes, validate user submissions, and manage multi-channel authentication workflows.

## Scope

Does not manage user accounts, store passwords, or provide full authentication flows - use only for OTP generation, delivery, and verification as part of broader authentication systems.

## Capabilities

- Send OTP codes via SMS, Viber, Voice (flash call or TTS), and Telegram channels
- Verify user-submitted OTP codes with expiration and attempt tracking
- Manage OTP lifecycle including generation, delivery, validation, and expiration
- Track delivery status and retry failed OTP deliveries across channels
- Configure OTP parameters including code length, expiration time, and retry limits
- Retrieve OTP history and delivery logs for auditing and debugging
- Support fallback channels when primary delivery method fails

## Use cases

### Two-Factor Authentication (2FA)

Add 2FA to login flows by sending OTP codes during authentication. POST `/otp/send` delivers the code via SMS or other channels, and POST `/otp/verify` validates the user-submitted code. The API tracks expiration and attempt limits to prevent brute-force attacks. Supports fallback channels if primary delivery fails, ensuring reliable 2FA even with carrier issues.

Example prompt: POST `/otp/send` with the user's phone number and preferred channel (SMS), then POST `/otp/verify` with the code the user submits to complete 2FA.

### Phone Number Verification

Verify phone numbers during user registration or profile updates. POST `/otp/send` delivers a verification code, and POST `/otp/verify` confirms the user owns the phone number. This prevents fake accounts, ensures contact reachability, and supports regulatory compliance for identity verification. Multi-channel support handles international numbers and regional carrier preferences.

Example prompt: POST `/otp/send` with the phone number during registration, then POST `/otp/verify` with the submitted code to confirm ownership before activating the account.

### Passwordless Authentication

Implement passwordless login by sending OTP codes as the primary authentication method. Users enter their phone number or username, receive an OTP, and gain access upon successful verification. Eliminates password management overhead, reduces credential theft risk, and simplifies login UX. The API's retry logic and multi-channel support ensure reliable delivery.

Example prompt: POST `/otp/send` with the user's phone number when they request login, then POST `/otp/verify` with their submitted code to grant access without password.

### Transaction Authorization

Secure high-value transactions or sensitive operations by requiring OTP verification. Before processing payments, account changes, or data access, send an OTP and require verification. This adds a real-time authorization layer that confirms user intent and prevents unauthorized actions even if sessions are compromised.

Example prompt: Before processing the transaction, POST `/otp/send` to the user's registered phone, then POST `/otp/verify` with their code before completing the sensitive operation.

### AI Agent for Authentication Operations

Let an AI agent handle OTP workflows for a SaaS platform - sending verification codes during signup, validating codes during login, and managing retry logic for failed deliveries. Through Jentic, the agent loads only the required operations and GetOTP API keys are injected at execution time.

Example prompt: Use the Jentic search query 'send otp code' to find POST `/otp/send`, load its schema, and execute with the user's phone number and preferred channel.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/otp/send` | Send an OTP code via SMS, Viber, Voice, or Telegram |
| POST | `/otp/verify` | Verify a user-submitted OTP code |
| POST | `/otp/resend` | Resend an OTP code if the original expired or failed |
| GET | `/otp/{id}` | Retrieve OTP delivery status and history |
| GET | `/otp` | List OTP sessions with filtering by status or date |

## Key resources

- **OTP Codes** — One-time passwords with configurable length, expiration, and delivery channels
- **Delivery Channels** — SMS, Viber, Voice (flash call or TTS), and Telegram options for OTP delivery
- **Verification Sessions** — OTP lifecycle tracking including generation, delivery, attempts, and expiration
- **Delivery Logs** — History of OTP deliveries with status tracking and retry information
- **Channel Fallbacks** — Automatic retry with alternative channels when primary delivery fails

## Why Jentic

- **Setup:** Wiring GetOTP by hand means setting up the X-OTP-Key header, targeting the api.otp.dev host, and managing your own retries across send, verify, and resend calls. Through Jentic you install once, import the GetOTP API from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** GetOTP puts the OTP id in the URL path (`/otp/{id}`), so a rule can pin your agent to reading one OTP request. You choose the operations it may call, so sending, verifying, or resending are not included unless you add them, and a status-checking agent can read without triggering new codes.
- **Credential handling:** Your GetOTP API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'send a one-time passcode' or 'verify a submitted code', and Jentic returns the matching GetOTP operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Twilio Verify API** — Alternative OTP and verification API with SMS and voice channels.
- **Auth0 API** — Full authentication platform that can use GetOTP for phone verification and MFA.

## FAQ

### What authentication does the GetOTP API use?

The GetOTP API uses bearer token authentication. API keys are obtained from the GetOTP dashboard and sent via the Authorization header. Through Jentic, keys are stored encrypted and injected at execution time.

### What channels does GetOTP support for OTP delivery?

GetOTP supports SMS, Viber, Voice (flash call or TTS), and Telegram. The API automatically handles channel selection and fallback if the primary channel fails.

### How long are OTP codes valid?

OTP code expiration is configurable per request, typically 5-10 minutes. The API enforces expiration automatically during verification and tracks attempt counts to prevent brute-force attacks.

### Can I customize the OTP code length and format?

Yes, the API supports configurable code length (typically 4-8 digits) and format. You can also customize the message template for SMS and Voice deliveries.

### What happens if OTP delivery fails?

The API provides delivery status tracking via GET `/otp/{id}.` You can retry failed deliveries with POST `/otp/resend`, optionally specifying a fallback channel. The API also supports automatic fallback to alternative channels.

### What are the rate limits for the GetOTP API?

Rate limits depend on your GetOTP plan and are enforced per API key. Check your dashboard for specific limits. The API returns HTTP 429 when limits are exceeded, with Retry-After headers.

### Can I limit what my agent is allowed to do with the GetOTP API?

Yes. Because you run Jentic One yourself, your own rules decide which GetOTP operations the agent may call and which credentials it may use, so you can grant read-only access to GET `/otp/{id}` for delivery status while withholding POST `/otp/send`, POST `/otp/verify`, and POST `/otp/resend.` GetOTP puts the OTP id in the URL path, so a rule can pin the agent to reading a single OTP request rather than triggering new codes. Sending, verifying, or resending are only available to the agent when you add those operations to its scope.