Skip to content

SMS OTP API · India

Phone verification that just arrives.

You send the number and your code. We deliver it by SMS on DLT-registered routes and tell you the moment it lands.

Get API key Read the docs
per SMS, from
₹0.19
registered headers
DLT
monthly fee
₹0
AD-CNCTOTText message · SMS
482915is your OTP for Acme. Valid for 5 minutes. Do not share it with anyone. -connectotp

Delivered via SMS · 2.4s

01 · How it works

One call, one code, one yes.

  1. 01Your server sends number + codeOne HTTPS POST with the phone number and the code you generated.
  2. 02We send it by SMSOn DLT-registered headers and templates, through Indian telecom operators.
  3. 03Your user types the codeInto your app, as soon as the SMS lands.
  4. 04Your server checks itYou generated the code, so you compare it. The browser never decides.
  5. 05A signed webhook followsotp.delivered with the delivery status and timing, signed with HMAC-SHA256.
POST /your-webhook · otp.delivered
{
  "type": "otp.delivered",
  "id": "evt_8fJ2kQ",
  "created": 1760883021,
  "data": {
    "message_id": "msg_3hT9cA",
    "phone": "+9198XXXXX678",
    "status": "delivered",
    "latency_ms": 2410
  }
}

02 · Try it

Be your own server for a minute.

Demo — no message is actually sent. Delivery is simulated with a short delay.

01 · Your server sends

POST /v1/otp
{
  "phone": "+91··········",
  "code": "731406"
}

AD-CNCTOTText message · SMS

No messages yet

03 · For developers

One HTTPS call. You keep the code.

No SDK to install. POST the phone number and your code from any language; we handle DLT, operator delivery and delivery reports.

cURLPOST /v1/otp
# 1. Send the code you generated, from your server
curl https://api.connectotp.com/v1/otp \
  -u "$CONNECTOTP_SECRET_KEY:" \
  -H "Content-Type: application/json" \
  -d '{"phone": "+919812345678", "code": "482915"}'

# → {"id": "msg_3hT9cA", "status": "queued"}

# 2. When the user types the code, compare it on your server.
#    You generated it; you check it. Never in the browser.

# 3. Delivery webhooks are signed. Recompute the HMAC-SHA256 of
#    "<X-ConnectOTP-Timestamp>.<raw body>" and compare it with
#    the X-ConnectOTP-Signature header:
printf '%s.%s' "$TIMESTAMP" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$CONNECTOTP_WEBHOOK_SECRET"
Dashboard · live delivery log
TimePhoneStatusLatency (ms)
14:02:11+91 98XXX X5678delivered2,410
14:02:07+91 70XXX X1290delivered1,980
14:01:58+91 91XXX X0043failed—
14:01:40+91 88XXX X7716blocked—

04 · Security & reliability

Boring on purpose.

The parts of OTP that fail quietly, handled by default.

  1. 01

    Hashed codes

    We keep only a hash of each code you send, never the code itself.

  2. 02

    Secret-key auth

    Every request is signed with your secret key over HTTPS. Keys never belong in a browser.

  3. 03

    HMAC-signed webhooks

    Every webhook carries an HMAC-SHA256 signature you can check.

  4. 04

    Rate limits and spend caps

    Limits per phone number, IP and API key, plus a daily cap on spend.

  5. 05

    SMS-pumping protection

    We spot bursts to premium or sequential numbers and block them before they cost you.

  6. 06

    DLT compliance

    SMS goes out on TRAI DLT-registered headers and templates.

  7. 07

    Delivery logs

    Every send, its status and latency, in your dashboard.

  8. 08

    Data stored in India

    Numbers and logs are stored on servers in India, and SMS goes out through Indian operators.

05 · FAQ

Questions, answered plainly.

Who generates the code?

You do. Your server creates the code, sends it with the phone number to our API, and checks what the user types. We deliver it.

Is there an SDK?

No. It’s one HTTPS endpoint with JSON in and out, so any language that can make a POST request works.

What is DLT?

TRAI’s Distributed Ledger Technology registry. Every commercial SMS in India must use a registered sender header and template. connectotp sends OTPs on DLT-registered headers and templates, so your messages aren’t dropped by operators.

What if an SMS isn’t delivered?

The webhook and the dashboard show the failed status and the operator’s reason. Your server decides whether to send again, with the same code or a new one.

Do credits expire?

Credits are valid for 12 months from purchase. There is no monthly fee.

How do you stop fraud?

Rate limits per phone, IP and API key; daily spend caps you set; and detection for SMS-pumping patterns. Suspicious sends are blocked before they cost you.

Can I use my own sender ID?

Yes, on Enterprise. We help register your own DLT header and templates.

Which countries?

India first. Numbers must be +91 today. Other countries are on the roadmap.

How fast is delivery?

Most SMS OTPs land within a few seconds, though operator conditions vary. Every send shows its timing in the dashboard.

Send a code. Get a yes. Move on.

Get your API key

From ₹0.19 per OTP. Prepaid, no monthly fee. See pricing