- User registration
- Login verification
- Multi-factor authentication (MFA)
- Password recovery
- Transaction authorization
- Device verification
- Email verification
- KYC verification
How It Works
The OTP verification flow consists of two steps:- Request an OTP
- Verify an OTP
Core Endpoints
OTP Lifecycle
Session-Based Verification
Every OTP request generates a unique session identifier. Example:sessionId must be supplied when verifying an OTP.
Security Features
Expiration
OTPs automatically expire after a configured validity period.
Attempt Limits
Verification attempts are limited to reduce brute-force attacks.
Replay Protection
Successfully verified OTPs cannot be reused.
Workspace Isolation
OTP sessions are isolated per workspace.
Supported OTP Purposes
OTP requests must be associated with a business purpose. Supported values:OTP Reuse
Zeckta can reuse an active OTP session when a valid OTP already exists for the same destination and purpose. This helps reduce unnecessary SMS traffic and improves user experience. When an existing OTP is reused:When OTP reuse occurs, clients should continue using the existing session identifier and OTP code until the session expires.
OTP Expiration
OTPs remain valid for a limited period. Default behavior:Verification Outcomes
Verification attempts can result in the following statuses:Workspace Isolation
OTP sessions are isolated by workspace. A workspace can only:- Request OTPs using its own API key
- Verify OTPs generated within its own workspace
- Access sessions associated with its own credentials
Security Best Practices
- Always use HTTPS when transmitting OTPs.
- Never expose API keys in client-side applications.
- Do not log OTP codes in plaintext.
- Verify OTPs immediately after delivery.
- Treat session identifiers as sensitive credentials.
- Expired or used OTPs should not be reused.
Next Steps
Request OTP
Generate and deliver an OTP.
Verify OTP
Verify an OTP using a session identifier.