Use cases
Phone verification with WhatsApp OTP
Send a login or sign-up code to WhatsApp instead of SMS. Two endpoints, and the code never touches your servers.
Two endpoints
POST /v1/otp/send generates a code and delivers it. POST /v1/otp/verify checks what the user typed. You keep a request ID between the two calls and nothing else.
Codes are stored hashed
Oxtro stores only a hash of each code. A code works once, expires after 1 to 60 minutes, and locks after too many wrong tries.
Limits that slow down abuse
A resend cooldown and hourly and daily caps per phone number stop a form from being used to flood someone. Every send, success and failure is also available as a webhook event.
Your wording, your number
The code arrives in a chat from your own WhatsApp number, with text from an OTP template you write. Choose 4 to 8 digits.
How it works
Request a code
Call /v1/otp/send with the phone number and keep the request_id in the session.
The user gets the code
It arrives on WhatsApp from your connected number.
Verify the entry
Send request_id and the typed code to /v1/otp/verify. HTTP 200 means verified.
Send a code
The response contains request_id and expires_in in seconds. Then verify the code.
curl https://api.getoxtro.com/v1/otp/send \
-H "Authorization: Bearer $OXTRO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"connection_id": "conn_123",
"to": "+213555123456",
"code_length": 6,
"expires_in_minutes": 5
}'Questions about WhatsApp OTP
What happens when the user types a wrong code?
The verify endpoint answers HTTP 400 with the code OTP_INVALID and the number of attempts left. After too many wrong tries the request locks with OTP_MAX_ATTEMPTS and a new code has to be sent.
Does Oxtro fall back to SMS if the user is not on WhatsApp?
No. Oxtro delivers over WhatsApp only. If you need a fallback, keep one of your own for numbers that cannot receive the code.
How long is a code valid?
You choose from 1 to 60 minutes per request or as a workspace setting. The default is 5 minutes.
Can my server see the code?
No. Oxtro generates the code and sends it straight to WhatsApp. Your server only receives a request ID, then a yes or no when it asks for verification.
Related
Connect your first number today
Create a workspace, scan the QR code and send a message.