Authentication

Every request to the otp.com API authenticates with an API key, sent as a Bearer token in the Authorization header.

Authorization: Bearer otp_live_YOUR_API_KEY

Test vs live keys

You create keys per app on the API Keys screen, in one of two environments:

Prefix	Environment	Behavior
otp_test_…	Sandbox	No real message is sent, nothing is charged. The accepted code is always 123456.
otp_live_…	Production	Real delivery over your configured channels, billed per verification sent.

Use a test key while you build and in automated tests. Switch to a live key only when you are ready to send real codes.

Keeping keys safe

• Never ship a key to the browser or a mobile app. All otp.com calls happen from your backend. A leaked live key can send real messages against your balance.
• Read the key from an environment variable, not from source. Rotate it if it is ever exposed.
• Keys can be revoked at any time on the API Keys screen. A revoked or invalid key returns 401.

Errors

A missing, malformed, or revoked key returns HTTP 401 with the standard error envelope:

{
  "error": {
    "type": "HTTPException",
    "message": "Missing, invalid, or revoked API key."
  }
}

See Error codes for the full list.