Quick answer
To send OTPs, register an OTP template on DLT, then call the SMS API from your server each time a user needs a code.
Steps
- Register an OTP template, for example: {#var#} is your OTP to log in to BrandName. Valid for 10 minutes. Do not share it. - BRAND
- Generate the OTP on your server, not in the app or browser.
- Call the API with the number, sender ID, template and message.
- Store the OTP securely with an expiry time, and verify what the user enters.
Security tips
- Never send the API key to the browser or mobile app. Call the API from your server.
- Limit how many OTPs one number or IP can request in a few minutes.
- Let OTPs expire after a few minutes, and allow a resend only after a short wait.
See OTP message formats and the SMS API page.
More questions
How fast are OTP SMS delivered?
OTPs travel on priority routes and are usually delivered in seconds. Check timestamps in your delivery report.
Can OTP be sent on WhatsApp?
Yes. You can send OTPs on WhatsApp with an authentication template, and fall back to SMS if needed.
How long should an OTP be valid?
Most businesses use 5 to 10 minutes. Mention the validity in the template.
Was this answer helpful?Still have a question? Contact our team or WhatsApp us.