OTP Verification in Make

Make reaches otp.com through the REST API. Two HTTP modules and a filter turn a scenario into a verification step.

Get Your API Key Free API docs

Make

Ready

HTTP · Make a request POST /otp/send
Response mapped otp_id
HTTP · Make a request POST /otp/verify
Filter status equals "approved"

Run once: verify +14155552671

Make · REST API

Set up otp.com in Make

Add an HTTP "Make a request" module: POST https://api.otp.com/api/v1/otp/send with an Authorization header of Bearer otp_live_your_key_here (use an otp_test_ key while you build). Set the body to JSON with recipient, locale and client_ip (the end user’s IP, not the server’s). The response carries the otp_id. Add a second "Make a request" module: POST https://api.otp.com/api/v1/otp/verify with the same header and a JSON body of otp_id and code. Add a filter on the next route that passes only when status equals "approved".

API docs

Try the two calls

james · zsh · 80×24

% curl -X POST https://api.otp.com/api/v1/otp/send \ -H "Authorization: Bearer otp_test_your_key_here" \ -H "Content-Type: application/json" \ -d '{"recipient":"+14155552671","locale":"en","client_ip":"<end_user_ip>"}'

{"otp_id":"9f3c1b2a-…","status":"pending","channel":"sms"}

SEND

curl -X POST https://api.otp.com/api/v1/otp/send \
  -H "Authorization: Bearer otp_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"recipient":"+14155552671","locale":"en","client_ip":"<end_user_ip>"}'

james · zsh · 80×24

% curl -X POST https://api.otp.com/api/v1/otp/verify \ -H "Authorization: Bearer otp_test_your_key_here" \ -H "Content-Type: application/json" \ -d '{"otp_id":"9f3c1b2a-…","code":"123456"}'

{"otp_id":"9f3c1b2a-…","status":"approved","matched":true}

VERIFY

curl -X POST https://api.otp.com/api/v1/otp/verify \
  -H "Authorization: Bearer otp_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"otp_id":"9f3c1b2a-…","code":"123456"}'

Building it with an AI assistant?

If an AI assistant builds the workflow for you, give it this prompt: it carries the endpoints, request shapes and sandbox rules.

INTEGRATION PROMPT

Integrate otp.com OTP verification into this project.

API docs: https://otp.com/docs
Base URL: https://api.otp.com/api/v1
Auth: Bearer token in the Authorization header

## Step 1: Send a code
POST /otp/send
Body: { "recipient": "+14155552671", "locale": "en", "client_ip": "<end user's IP>" }
→ Returns { "otp_id": "9f3c1b2a-…", "status": "pending", "channel": "sms" }

## Step 2: Verify the code the user entered
POST /otp/verify
Body: { "otp_id": "9f3c1b2a-…", "code": "123456" }
→ Returns { "otp_id": "9f3c1b2a-…", "status": "approved", "matched": true }

Notes:
- recipient is a phone number (E.164) or an email; your account routing picks the channel.
- client_ip is the END USER's IP from the request context (e.g. req.ip), never the server's own; requests without it share a much tighter rate limit.
- The code is never returned by the API.
Sandbox test keys (otp_test_…) accept the fixed code 123456 on the default 6-digit length.

Full integration prompt as Markdown →

Other AI tools

Claude Code Skill Set up → Cursor Rules file Set up → Codex AGENTS.md Set up → GitHub Copilot Instructions file Set up → n8n REST API Set up → Replit Agent Prompt Set up → Lovable Prompt Set up →

Frequently Asked Questions

Is my API key safe?

The key sits in the Authorization header of your HTTP modules, so anyone who can edit the scenario can read it. Use a test key while you build, and share the scenario only with people who should have the key.

Does the agent see the code?

No. The API never returns the code. The user receives it on their phone or in their inbox, and your app verifies what they type against the otp_id from the send call.

Can I test without sending real messages?

Yes. A test key (otp_test_) runs in the sandbox: send returns a real otp_id and a pending status, but nothing is delivered and nothing is charged. Verify accepts the fixed code 123456 on the default 6-digit length.