OTP API Documentation & Integration Guide

Quickstart

Pick the integration that fits your team. You can switch later — both use the same keys and dashboard.

Authentication

All API requests are authenticated with a Bearer token. Your secret key (sk_live_…) must stay on your backend — never ship it to the browser or mobile app. The widget uses a public key (pk_live_…).

# Base URL
https://api.doneotp.com

# Header on every request
Authorization: Bearer sk_live_xxx

Managed widget

The fastest path. Add a container, load the script, and handle the result. We run the entire flow: phone input, country codes, OTP entry, resend timer and lockout.

<div id="doneotp"></div>

<script src="https://cdn.doneotp.com/widget.js"></script>
<script>
  DoneOTP.init({
    apiKey: "pk_live_xxx",        // public key
    elementId: "doneotp",
    theme: { brand: "#10B981" },  // match your UI
    onVerified: (res) => {
      // send the token to your backend to confirm
      verifyOnServer(res.token);
    },
    onFailed: (err) => console.warn(err)
  });
</script>

REST API

Build your own UI and call two endpoints from your server. Example: send a code, then check it.

# 1 · Send a code
curl https://api.doneotp.com/v1/verify/send \
  -H "Authorization: Bearer sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "phone_number": "+14155552671" }'

# 2 · Check the code
curl https://api.doneotp.com/v1/verify/check \
  -H "Authorization: Bearer sk_live_xxx" \
  -d '{ "phone_number": "+14155552671", "code": "493812" }'

API playground

Edit the phone number and OTP code below to generate a ready-to-run cURL command. Calls are not executed — this is a sandbox preview.

# Send OTP
curl https://api.doneotp.com/v1/verify/send \
  -H "Authorization: Bearer sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "phone_number": "+14155552671" }'

Endpoints

// 200 OK
{ "status": "pending", "expires_in": 300 }

// 200 OK
{ "status": "verified", "token": "tok_xxx" }

// 200 OK
{ "valid": true, "phone_number": "+90532****2719" }

Status codes

SDKs

Official client libraries for popular stacks. REST API works with any HTTP client today — SDKs ship soon.

Webhooks

Receive server-side events when verifications complete or fail. Configure webhook URLs in the dashboard — we sign each payload with your secret so you can verify authenticity.

POST https://your-app.com/webhooks/doneotp
Content-Type: application/json
X-DoneOTP-Signature: sha256=...

{
  "event": "verification.completed",
  "verification_id": "ver_xxx",
  "phone_number": "+90532****2719",
  "token": "tok_xxx"
}

Rate limits

Default limits protect against abuse and SMS pumping. Volume plans can request higher thresholds via sales@doneotp.com.

Security best practices

• Keep your sk_live_… key server-side only.
• Add an IP allowlist so the key only works from your servers.
• In Managed mode, always confirm the token via /validate-token — never trust the browser.
• We mask phone & IP at the write layer and never store the OTP in plain text.

Developer FAQ