MCP server

The otp.com MCP server lets an AI agent run verification for you. Point any MCP client (Claude Desktop, Claude Code, Cursor, or your own agent) at it, and the assistant can send a code, verify what the user entered, resend on the next channel, and check status, all through your API key.

It is a thin, self-contained client of the same public OTP API. There is no backend code to run and no secret in the source: you supply your API key at runtime through an environment variable.

Setup

1. Create an API key in the panel (API Keys). A otp_live_… key sends for real; a otp_test_… key runs in the sandbox.
2. Add the server to your MCP client. Most CLIs take a one-liner:

# Claude Code
claude mcp add otp -s user -e OTP_API_KEY=otp_live_your_key_here -- npx -y @otp.com/mcp

# Codex
codex mcp add otp --env OTP_API_KEY=otp_live_your_key_here -- npx -y @otp.com/mcp

# VS Code
code --add-mcp '{"name":"otp","command":"npx","args":["-y","@otp.com/mcp"],"env":{"OTP_API_KEY":"otp_live_your_key_here"}}'

-s user registers the server for every project; drop it for the current one only. All three write the key into a config file in plain text, and it lands in your shell history too. On a shared machine, or with a live key, edit the config file by hand instead.

Clients configured by file (Claude Desktop, Cursor, your own agent) take the same server as JSON:

{
  "mcpServers": {
    "otp": {
      "command": "npx",
      "args": ["-y", "@otp.com/mcp"],
      "env": {
        "OTP_API_KEY": "otp_live_your_key_here"
      }
    }
  }
}

That is all. The client launches the server with npx; no global install needed. Requires Node 18+. The server speaks stdio, so your client spawns it: there is no port to open and nothing to deploy.

Configuration

Env var	Required	Default	Notes
OTP_API_KEY	yes	none	Your API key, sent as the Bearer token. The only credential.
OTP_API_BASE_URL	no	https://api.otp.com/api/v1	Override for staging or self-hosted.

Tools

The server exposes one tool per API action:

Tool	Does	Input
send_otp	Send a code (channel chosen by your account routing)	recipient, locale?, client_ip?
verify_otp	Verify the code the user entered	otp_id, code
resend_otp	Resend on the next channel, or one you name	otp_id, channel?
get_otp_status	Check an OTP’s status	otp_id

client_ip is the IP of the end user being verified, when your application has it from its own request context. Pass it whenever you can: requests without it share a much tighter rate limit and skip IP-based abuse protection. Never invent one, and never send the machine’s own address, which is what an agent will reach for if you let it.

As with the REST API, the code is never returned. The agent verifies against the otp_id returned by send_otp. When routing picks WhatsApp, send_otp may also return an action_url: the agent surfaces that link so the user opens it and receives the code over chat, then calls verify_otp with what they entered, exactly as on any other channel. The WhatsApp shapes, and the one that approves without a code, are covered in WhatsApp verification.

Why this matters

Verification is usually glue code someone has to write and maintain. With the MCP server, an agent can wire up and drive the whole flow in a single prompt: send to a user, wait for the code, verify it, fall back a channel if needed. It is the fastest way to add real OTP verification to an AI-built product.

The server is open source: otp-com/mcp on GitHub, @otp.com/mcp on npm.

Prefer to call the API directly? See the REST reference, the SDKs, or the copy-paste code examples.