Skip to main content

Verify users with OTP

Inttegro OTP verification currently confirms control of an international phone number by SMS. Initiate a transaction, collect the code in your own user interface, and grant access only after the recorded verification attempt has a pass verdict.

Prerequisites

  • An opaque API key stored outside client-side code
  • A normalized international phone number for the user
  • A pending authentication record that can hold an ot_<TRANSACTION_ID> value

Apply the verification result

Use the complete implementation in Verify users with OTP. The same security boundary applies to sign-in, registration, and step-up checks: HTTP 200 confirms that an attempt was recorded, not that the supplied token matched.

Check verification_attempt.result.verdict and accept only pass. A failed match returns fail in the same HTTP 200 response, so transaction status or transport success must not be used as authorization proof. Do not log submitted tokens or verification bodies.

OTP transactions can report pending_delivery while awaiting transmission details and pending_verification after the SMS was sent. IDs use the ot_ prefix and timestamps are RFC 3339 strings.