Validate OTP code
curl --request POST \
--url https://app.hypersender.com/api/otp/v2/{instance}/validate-code \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"chatId": "[email protected]",
"code": "439713"
}
'import requests
url = "https://app.hypersender.com/api/otp/v2/{instance}/validate-code"
payload = {
"chatId": "[email protected]",
"code": "439713"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({chatId: '[email protected]', code: '439713'})
};
fetch('https://app.hypersender.com/api/otp/v2/{instance}/validate-code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.hypersender.com/api/otp/v2/{instance}/validate-code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'chatId' => '[email protected]',
'code' => '439713'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.hypersender.com/api/otp/v2/{instance}/validate-code"
payload := strings.NewReader("{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.hypersender.com/api/otp/v2/{instance}/validate-code")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.hypersender.com/api/otp/v2/{instance}/validate-code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "OTP code validated successfully",
"data": {
"uuid": "a0b5df6a-b491-4190-80a5-38d85a2a4836",
"chat_id": "[email protected]",
"status": "validated",
"validated_at": "2025-12-29T17:43:36+00:00"
}
}Validate an OTP code previously generated for a chat to confirm user authentication.
POST
/
{instance}
/
validate-code
Validate OTP code
curl --request POST \
--url https://app.hypersender.com/api/otp/v2/{instance}/validate-code \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"chatId": "[email protected]",
"code": "439713"
}
'import requests
url = "https://app.hypersender.com/api/otp/v2/{instance}/validate-code"
payload = {
"chatId": "[email protected]",
"code": "439713"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({chatId: '[email protected]', code: '439713'})
};
fetch('https://app.hypersender.com/api/otp/v2/{instance}/validate-code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.hypersender.com/api/otp/v2/{instance}/validate-code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'chatId' => '[email protected]',
'code' => '439713'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.hypersender.com/api/otp/v2/{instance}/validate-code"
payload := strings.NewReader("{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.hypersender.com/api/otp/v2/{instance}/validate-code")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.hypersender.com/api/otp/v2/{instance}/validate-code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"chatId\": \"[email protected]\",\n \"code\": \"439713\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "OTP code validated successfully",
"data": {
"uuid": "a0b5df6a-b491-4190-80a5-38d85a2a4836",
"chat_id": "[email protected]",
"status": "validated",
"validated_at": "2025-12-29T17:43:36+00:00"
}
}Overview
Verify an OTP code that was previously sent to a user via the Request OTP Code endpoint. This endpoint checks if the provided code matches the active OTP for the given chat ID.How It Works
- User receives OTP code via WhatsApp
- User enters the code in your application
- Send the
chatIdandcodeto this endpoint - The system validates:
- Code matches the active OTP
- Code hasn’t expired
- Code hasn’t been used already
- Returns validation result with status update
Quick Demo
Learn how to send an OTP code using Postman: Demo Link
Parameters
chatId (required)
The WhatsApp chat ID that received the OTP code (e.g.,[email protected])
code (required)
The OTP code provided by the user to validateShowcase Example Message

Response
The response includes:success: Boolean indicating if validation was successfulmessage: Descriptive message about the validation resultdata.uuid: The unique identifier of the OTP requestdata.chat_id: The chat ID associated with this OTPdata.status: Updated status (typicallyvalidatedon success)data.validated_at: ISO 8601 timestamp when the code was validated
View All of your OTP Requests

Validation Rules
The code validation will fail if:- The code doesn’t match the active OTP for the chat
- The code has expired based on the
expiresparameter - The code has already been validated (codes are single-use)
- No active OTP exists for the provided
chatId
Usage Example
use Illuminate\Support\Facades\Http;
$response = Http::withToken('YOUR_API_TOKEN')
->post('https://app.hypersender.com/api/otp/v2/{instance}/validate-code', [
'chatId' => '[email protected]',
'code' => '439713',
]);
$result = $response->json();
if (($result['success'] ?? false) && (($result['data']['status'] ?? '') === 'validated')) {
// Code is valid - proceed with user authentication
info('User verified successfully!');
} else {
// Code is invalid or expired
info('Verification failed: ' . ($result['message'] ?? 'Unknown error'));
}
Error Handling
Common validation failures:- Invalid Code: The code doesn’t match
- Expired Code: The TTL period has passed
- Already Used: The code was previously validated
- No Active OTP: No pending OTP found for this chat
OTP codes are single-use only. Once validated successfully, the same code cannot be used again. Users will need to request a new code if they need to authenticate again.
Security Best Practices
- Rate Limiting: Implement rate limiting on validation attempts to prevent brute-force attacks
- Maximum Attempts: Consider limiting failed validation attempts (e.g., 3-5 tries) before requiring a new code
- Secure Storage: Never log or store OTP codes in plain text
- HTTPS Only: Always use HTTPS for API calls containing OTP codes
- Short Expiration: Use shorter expiration times (5-10 minutes) for sensitive operations
After successful validation, immediately proceed with your authentication flow. The validated status ensures this specific OTP cannot be reused.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Hypersender instance UUID