blacksms
OTP API

Verification that is hard to abuse.

Three endpoints — send, verify, resend — with cooldowns, attempt ceilings and hashed code storage as defaults, not options.

Endpoints

Send
curl -X POST https://api.blacksms.in/api/v1/otp/send \
  -H "Authorization: Bearer bsk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone": "919876543210",
    "sender_id": "BLKSMS",
    "purpose": "login",
    "code_length": 6,
    "expiry_seconds": 300
  }'
  • Codes are hashed with the destination number, never stored in readable form
  • Configurable code length (4–8), expiry, maximum attempts and resend cooldown
  • A new code cancels the previous pending code for that number
  • Every verification attempt is logged with its source IP
  • otp.sent, otp.verified and otp.failed events fire on your webhooks