OTP API

Use the OTP API when your application needs phone verification by SMS. For WhatsApp plus SMS OTP, use Unified OTP.

Send OTP

POST {{baseUrl}}/api/sms/otp/send

curl -X POST "{{baseUrl}}/api/sms/otp/send" \
  -H "Authorization: Bearer kfotp_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+255700000000"
  }'

Send response

{
  "success": true,
  "message": "OTP sent",
  "data": {
    "pinId": "123456789",
    "recipient": "255700000000",
    "status": "sent"
  }
}

Store pinId on your server. Ask the customer for the code, then call verify.

Verify OTP

POST {{baseUrl}}/api/sms/otp/verify

curl -X POST "{{baseUrl}}/api/sms/otp/verify" \
  -H "Authorization: Bearer kfotp_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "pinId": "123456789",
    "pin": "1234"
  }'

Aliases accepted for the code: pin, otp, or code.

Logs

GET {{baseUrl}}/api/sms/otp/logs?limit=50

curl "{{baseUrl}}/api/sms/otp/logs?limit=50" \
  -H "Authorization: Bearer kfotp_your_token"

Billing

Sending an OTP consumes SMS balance after the gateway accepts the request.
Verification does not consume SMS balance.
Failed sends, incorrect PINs, and expired PINs are logged for debugging.

Best practices

Store pinId server-side.
Do not trust OTP verification done in browser-only code.
Rate limit signup/login forms before calling the OTP API.
Do not expose the OTP token in mobile apps.

Start Here

Messaging APIs

Operations

SDKs

Reference

Send OTP

Send response

Verify OTP

Logs

Billing

Best practices

​Send OTP

​Send response

​Verify OTP

​Logs

​Billing

​Best practices

Send OTP

Send response

Verify OTP

Logs

Billing

Best practices