How to Send an OTP via WhatsApp, SMS, Email, or Misscall

OTP.ID gives you two ways to deliver a one-time password to your users. Use POST /v3/request when you want OTP.ID to generate or create the OTP transaction for you. Use POST /v3/send when your application needs to supply the code itself for message-based outbound channels. Missed Call and WhatsApp Inbound are request-only flows.

Option A: Server-generated code — `POST /v3/request`

When you call this endpoint, OTP.ID generates a numeric code, delivers it to the user over the channel you choose, and returns a transaction record. The code itself is never included in the response — only the user receives it.

The OTP code is never returned in the API response. OTP.ID delivers it directly to the user over the requested channel. Your server only ever sees the otp_id transaction reference.

Supported channels

`channel` value	Delivery method
`whatsapp`	WhatsApp message
`sms`	SMS text message
`email`	Email message
`misscall`	Missed call (code derived from caller ID)
`whatsapp_inbound`	User-initiated WhatsApp message — see the WhatsApp Inbound guide

Need channel-specific rules or UI details? See the WhatsApp guide, SMS guide, Email guide, Missed Call guide, and WhatsApp Inbound guide.

Request body

Field	Required	Description
`channel`	✅	Delivery channel (see table above)
`destination`	✅ (except `whatsapp_inbound`)	Phone number (digits only, min 10 chars) or email address
`brand`	❌	Brand name shown in message-based OTP channels. Defaults to your account’s `brand_name`; not needed for `misscall`.
`otp_length`	❌	Code length from 4 to 8 digits. Default `6`. Values outside the range are clamped — never rejected.
`ttl`	❌	Seconds until the OTP expires. Range 60–900. Default `300`. Clamped, never rejected.
`external_id`	❌	Your own idempotency key. See the Idempotency guide.

The legacy number field is still accepted for backward compatibility, but destination is the recommended field for all new integrations because it can represent either a phone number or an email address without ambiguity.

Set brand to your product or company name so users immediately recognise message-based OTPs. For example, "brand": "TokoKita" produces a message like “Your TokoKita verification code is 482913”. If you leave it out, OTP.ID falls back to the brand_name configured in your account settings. For misscall, omit brand because verification comes from the caller ID, not a message body.

Examples

curl -X POST https://api.otp.id/v3/request \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp",
    "destination": "6281234567890",
    "brand": "TokoKita",
    "otp_length": 6
  }'

curl -X POST https://api.otp.id/v3/request \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "sms",
    "destination": "6281234567890",
    "brand": "TokoKita"
  }'

curl -X POST https://api.otp.id/v3/request \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "email",
    "destination": "user@example.com",
    "brand": "TokoKita"
  }'

curl -X POST https://api.otp.id/v3/request \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "misscall",
    "destination": "6281234567890"
  }'

curl -X POST https://api.otp.id/v3/request \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp_inbound",
    "brand": "TokoKita"
  }'

Success response

A 200 OK response with "status": "sent" means the message was accepted for delivery.

{
  "success": true,
  "data": {
    "otp_id": "OTP20260807ABCD000001",
    "status": "sent",
    "channel": "whatsapp",
    "number": "6281234567890",
    "price": 350,
    "last_balance": 99650,
    "expires_at": "2026-08-07 10:05:00"
  },
  "error": null
}

Failed delivery response

When a delivery attempt fails (for example, the number is unreachable), OTP.ID still returns HTTP 200 with "status": "failed". Credits are not deducted for failed deliveries.

{
  "success": true,
  "data": {
    "otp_id": "OTP20260807ABCD000002",
    "status": "failed",
    "channel": "sms",
    "number": "6281234567890",
    "price": 175,
    "last_balance": 99650,
    "expires_at": "2026-08-07 10:05:00"
  },
  "error": null
}

When status is "failed", last_balance is not reduced. Check status in your application code and decide whether to retry on a different channel.

Option B: Client-supplied code — `POST /v3/send`

Use this endpoint when your application generates the OTP code. Include your code in the otp field and OTP.ID will deliver it for you.

POST /v3/send supports only whatsapp, sms, and email.

The misscall and whatsapp_inbound channels are not supported by POST /v3/send. Use POST /v3/request for both flows.

Additional request field

Field	Required	Description
`otp`	✅	The code to deliver. Digits only, 4–8 characters. Example: `"482913"`

Use the same common fields as POST /v3/request where applicable: channel, destination, and brand. otp_length is ignored because the length is inferred from the otp value you provide.

Examples

curl -X POST https://api.otp.id/v3/send \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp",
    "destination": "6281234567890",
    "otp": "482913",
    "brand": "TokoKita"
  }'

curl -X POST https://api.otp.id/v3/send \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "sms",
    "destination": "6281234567890",
    "otp": "482913",
    "brand": "TokoKita"
  }'

curl -X POST https://api.otp.id/v3/send \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "email",
    "destination": "user@example.com",
    "otp": "482913",
    "brand": "TokoKita"
  }'

Success response

{
  "success": true,
  "data": {
    "otp_id": "OTP20260807ABCD000001",
    "status": "sent",
    "channel": "whatsapp",
    "number": "6281234567890",
    "price": 350,
    "last_balance": 99650,
    "expires_at": "2026-08-07 10:05:00"
  },
  "error": null
}

Response field reference

Field	Type	Description
`otp_id`	string	Unique transaction ID. Pass this to `POST /v3/verify`.
`status`	string	`"sent"` — delivery accepted. `"failed"` — delivery failed. `"pending"` — awaiting user action (WhatsApp Inbound).
`channel`	string	The channel used.
`number`	string	The resolved recipient phone number or email. This response field remains `number` for backward compatibility, even when the request uses `destination`.
`price`	integer	Cost in credits for this transaction.
`last_balance`	integer	Your remaining credits after this transaction.
`expires_at`	string	Expiry datetime in `YYYY-MM-DD HH:MM:SS` format (WIB, UTC+7).

Next steps

Verify the code the user enters with POST /v3/verify.
Prevent duplicate sends on retries with the Idempotency guide.
Use WhatsApp Inbound for a tap-to-verify flow with the WhatsApp Inbound guide.

Get Started

Core Concepts

Channel Guides

Guides

Reference

How to Send an OTP via WhatsApp, SMS, Email, or Misscall

Option A: Server-generated code — `POST /v3/request`

Supported channels

Request body

Examples

Success response

Failed delivery response

Option B: Client-supplied code — `POST /v3/send`

Additional request field

Examples

Success response

Response field reference

Next steps

​Option A: Server-generated code — POST /v3/request

​Supported channels

​Request body

​Examples

​Success response

​Failed delivery response

​Option B: Client-supplied code — POST /v3/send

​Additional request field

​Examples

​Success response

​Response field reference

​Next steps

Option A: Server-generated code — `POST /v3/request`

Supported channels

Request body

Examples

Success response

Failed delivery response

Option B: Client-supplied code — `POST /v3/send`

Additional request field

Examples

Success response

Response field reference

Next steps