Validate OTP Code

​

Overview

​

How It Works

1. User receives OTP code via WhatsApp
2. User enters the code in your application
3. Send the chatId and code to this endpoint
4. The system validates:
   • Code matches the active OTP
   • Code hasn’t expired
   • Code hasn’t been used already
5. Returns validation result with status update

​

Parameters

​

chatId (required)

​

code (required)

​

Showcase Example Message

​

Response

• success: Boolean indicating if validation was successful
• message: Descriptive message about the validation result
• data.uuid: The unique identifier of the OTP request
• data.chat_id: The chat ID associated with this OTP
• data.status: Updated status (typically validated on success)
• data.validated_at: ISO 8601 timestamp when the code was validated

​

View All of your OTP Requests

​

Validation Rules

• The code doesn’t match the active OTP for the chat
• The code has expired based on the expires parameter
• The code has already been validated (codes are single-use)
• No active OTP exists for the provided chatId

​

Usage Example

use Illuminate\Support\Facades\Http;

$response = Http::withToken('YOUR_API_TOKEN')
    ->post('https://app.hypersender.com/api/otp/v2/{instance}/validate-code', [
        'chatId' => '[email protected]',
        'code' => '439713',
    ]);

$result = $response->json();

if (($result['success'] ?? false) && (($result['data']['status'] ?? '') === 'validated')) {
    // Code is valid - proceed with user authentication
    info('User verified successfully!');
} else {
    // Code is invalid or expired
    info('Verification failed: ' . ($result['message'] ?? 'Unknown error'));
}

​

Error Handling

• Invalid Code: The code doesn’t match
• Expired Code: The TTL period has passed
• Already Used: The code was previously validated
• No Active OTP: No pending OTP found for this chat

​

Security Best Practices

1. Rate Limiting: Implement rate limiting on validation attempts to prevent brute-force attacks
2. Maximum Attempts: Consider limiting failed validation attempts (e.g., 3-5 tries) before requiring a new code
3. Secure Storage: Never log or store OTP codes in plain text
4. HTTPS Only: Always use HTTPS for API calls containing OTP codes
5. Short Expiration: Use shorter expiration times (5-10 minutes) for sensitive operations