Skip to content

OTP delivery API · India

Phone verification that just arrives.

You send the number and your code. We deliver it on WhatsApp first, and if it hasn’t landed in about 12 seconds, by SMS — automatically.

Get API key Read the docs
per WhatsApp OTP
₹0.18
before SMS fallback
12s
monthly fee
₹0
AcmeVerified business · WhatsApp
WhatsApp · Acme482915is your verification code. For your security, do not share this code.Copy code

Delivered via WhatsApp · 1.8s

01 · How it works

One code, two channels, one yes.

  1. 01Your server sends number + codeOne HTTPS POST with the phone number and the code you generated.
  2. 02We try WhatsApp firstCheaper, faster, and it shows your business name.
  3. 03No WhatsApp? SMS takes overNot on WhatsApp, or not delivered in ~12s: the same code goes by DLT-registered SMS.fallback after ~12s
  4. 04Your user types the codeThe same code, whichever channel delivered it.
  5. 05Your server checks itYou generated the code, so you compare it. The browser never decides.
  6. 06A signed webhook followsotp.delivered with the channel and timing, signed with HMAC-SHA256.
POST /your-webhook · otp.delivered
{
  "type": "otp.delivered",
  "id": "evt_8fJ2kQ",
  "created": 1760883021,
  "data": {
    "message_id": "msg_3hT9cA",
    "phone": "+9198XXXXX678",
    "channel": "sms",
    "fallback": true,
    "latency_ms": 3410
  }
}

02 · Try it

Be your own server for a minute.

Demo — no message is actually sent. Numbers ending 0–4 behave as if they’re on WhatsApp. Others fall back to SMS. Fallback is sped up from 12s to 3s here.

01 · Your server sends

POST /v1/otp
{
  "phone": "+91··········",
  "code": "731406",
  "channel": "smart"
}

AcmeVerified business · WhatsApp

No messages yet

03 · For developers

One HTTPS call. You keep the code.

No SDK to install. POST the phone number and your code from any language; we handle WhatsApp, SMS fallback and DLT.

cURLPOST /v1/otp
# 1. Send the code you generated, from your server
curl https://api.connectotp.com/v1/otp \
  -u "$CONNECTOTP_SECRET_KEY:" \
  -H "Content-Type: application/json" \
  -d '{"phone": "+919812345678", "code": "482915", "channel": "smart"}'

# → {"id": "msg_3hT9cA", "status": "queued", "channel": "whatsapp"}

# 2. When the user types the code, compare it on your server.
#    You generated it; you check it. Never in the browser.

# 3. Delivery webhooks are signed. Recompute the HMAC-SHA256 of
#    "<X-ConnectOTP-Timestamp>.<raw body>" and compare it with
#    the X-ConnectOTP-Signature header:
printf '%s.%s' "$TIMESTAMP" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$CONNECTOTP_WEBHOOK_SECRET"
Dashboard · live delivery log
TimePhoneChannelStatusLatency (ms)
14:02:11+91 98XXX X5678WhatsAppdelivered1,820
14:02:07+91 70XXX X1290SMS · fallbackdelivered3,410
14:01:58+91 91XXX X0043WhatsAppdelivered1,140
14:01:40+91 88XXX X7716SMSblocked—

04 · Security & reliability

Boring on purpose.

The parts of OTP that fail quietly, handled by default.

  1. 01

    Hashed codes

    We keep only a hash of each code you send, never the code itself.

  2. 02

    Secret-key auth

    Every request is signed with your secret key over HTTPS. Keys never belong in a browser.

  3. 03

    HMAC-signed webhooks

    Every webhook carries an HMAC-SHA256 signature you can check.

  4. 04

    Rate limits and spend caps

    Limits per phone number, IP and API key, plus a daily cap on spend.

  5. 05

    SMS-pumping protection

    We spot bursts to premium or sequential numbers and block them before they cost you.

  6. 06

    DLT compliance

    SMS goes out on TRAI DLT-registered headers and templates.

  7. 07

    Delivery logs

    Every send, its channel, fallback and latency, in your dashboard.

  8. 08

    Data stored in India

    Numbers and logs are stored on servers in India. WhatsApp delivery passes through Meta; SMS-only keeps it all in India.

05 · FAQ

Questions, answered plainly.

Who generates the code?

You do. Your server creates the code, sends it with the phone number to our API, and checks what the user types. We deliver it.

Is there an SDK?

No. It’s one HTTPS endpoint with JSON in and out, so any language that can make a POST request works.

What is DLT?

TRAI’s Distributed Ledger Technology registry. Every commercial SMS in India must use a registered sender header and template. connectotp sends OTPs on DLT-registered headers and templates, so your messages aren’t dropped by operators.

What happens if WhatsApp fails?

If the number isn’t on WhatsApp, or the message isn’t delivered within about 12 seconds, we send the same code by SMS. You make one call; the webhook tells you which channel delivered it.

Do credits expire?

Credits are valid for 12 months from purchase. There is no monthly fee.

How do you stop fraud?

Rate limits per phone, IP and API key; daily spend caps you set; and detection for SMS-pumping patterns. Suspicious sends are blocked before they cost you.

Can I use my own sender ID?

Yes, on Enterprise. We help register your own DLT header and templates.

Which countries?

India first. Numbers must be +91 today. Other countries are on the roadmap.

How fast is delivery?

WhatsApp messages usually land in one to three seconds. SMS fallback starts at about 12 seconds if WhatsApp hasn’t delivered. Every send shows its timing in the dashboard.

Send a code. Get a yes. Move on.

Get your API key

From ₹0.18 per OTP. Prepaid, no monthly fee. See pricing