POST

Verify WhatsApp OTP Code

Atomic & Secure

Atomically validates the one-time password submitted by your user against the Redis in-memory cache. Features automatic single-use burn (preventing replay attacks), 5-attempt brute-force protection, and constant-time cryptographic comparison.

Single-Use Auto-Burn & Brute-Force Lockout

Once verified successfully, the OTP is instantly burned from Redis to eliminate replay attacks. If an incorrect code is entered 5 times, the OTP is permanently invalidated to prevent brute-force attacks.

HTTP Endpoint

POSThttps://api-wa.hidessh.com/api/v1/otp/verify

Authentication

This endpoint requires Bearer authentication via your secret API Key.

Header Key	Value	Required
Authorization	Bearer hide_<your_api_key>	Required
Content-Type	application/json	Required

Request Parameters

The request body must be formatted as JSON with the following parameters:

Parameter	Type	Required	Description
`phone`	string	Required	Target recipient phone number in international E.164 format without spaces, dashes, or leading plus. Example: 628123456789. example: 628123456789
`otp`	string	Required	The 4-8 digit OTP code entered by the user to verify. example: 884920

Code Examples

request.sh

curl -X POST "https://api-wa.hidessh.com/api/v1/otp/verify" \
  -H "Authorization: Bearer hide_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "628123456789",
    "otp": "884920"
  }'

Response Formats

OTP code successfully validated and automatically burned from cache.

application/json • 200 OK

{
  "code": 200,
  "status": "success",
  "message": "OTP verified successfully",
  "data": {
    "phone": "628123456789",
    "verified": true
  }
}

Response Attributes Breakdown

Attribute	Type	Description
`data.phone`	string	Target normalized phone number.
`data.verified`	boolean	Confirmation boolean indicating successful verification.

Error Codes & Troubleshooting

Status	Error Code	Description	Recommended Action
400	`ERR_OTP_INVALID`	Submitted OTP code does not match the stored code.	Ask the user to check their WhatsApp messages and enter the correct code.
400	`ERR_OTP_NOT_FOUND`	OTP code has expired (exceeded 5 minutes) or was never requested.	Direct the user to tap 'Resend OTP' to receive a fresh verification code.
429	`ERR_OTP_MAX_ATTEMPTS`	Maximum invalid verification attempts (5 times) reached.	OTP code has been permanently deleted for anti-brute-force protection. User must request a new OTP.

On this page