OTP API - KarFlows

The SMS OTP API is available for accounts where the OTP product is enabled. For new integrations, use Unified OTP: it generates codes inside KarFlows and can route them through SMS or WhatsApp.

SMS OTP and Unified OTP use different tokens and pinId formats. Keep each send/verify pair on the same API.

Send OTP

POST https://karflows.com/api/sms/otp/send

curl -X POST "https://karflows.com/api/sms/otp/send" \
  -H "Authorization: Bearer kfotp_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+255700000000"
  }'

Send response

{
  "success": true,
  "message": "OTP sent",
  "data": {
    "pinId": "123456789",
    "recipient": "255700000000",
    "status": "sent"
  }
}

Store pinId on your server. Ask the customer for the code, then call verify.

Verify OTP

POST https://karflows.com/api/sms/otp/verify

curl -X POST "https://karflows.com/api/sms/otp/verify" \
  -H "Authorization: Bearer kfotp_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "pinId": "123456789",
    "pin": "1234"
  }'

Aliases accepted for the code: pin, otp, or code.

Logs

GET https://karflows.com/api/sms/otp/logs?limit=50

curl "https://karflows.com/api/sms/otp/logs?limit=50" \
  -H "Authorization: Bearer kfotp_your_token"

Billing

Sending an OTP consumes one SMS segment after the KarFlows delivery route accepts the request.
Verification does not consume SMS balance.
A synchronous send failure is refunded.
Incorrect, expired, and blocked verification attempts are logged.

Best practices

Store pinId server-side.
Do not trust OTP verification done in browser-only code.
Rate limit signup/login forms before calling the OTP API.
Do not expose the OTP token in mobile apps.