# OTP API integration

> Send one-time passcodes over SMS (POST /sms/sendSms) or WhatsApp authentication templates (POST /whatsapp/message/sendbulk). Generate and check the code in your own application, and track delivery through DLR webhooks.

- Canonical URL: https://www.broadnet.me/developers/otp
- Language: en
- Last updated: 2026-10-21
- Publisher: BroadNet (https://www.broadnet.me)

Send one-time passcodes with the same endpoints you use for any message. Generate the code in your backend, send it with POST /sms/sendSms (or as a WhatsApp authentication template with POST /whatsapp/message/sendbulk), and check what the user types against the code you stored. For code generation and validation as a managed service, see the OTP product page.

> **Keep the code server-side** Store a hash of the code with a short expiry, limit attempts per number, and never return the code in an API response to the client.

## Examples

### otp.ts

```typescript
import { randomInt } from "node:crypto";
import { Configuration, SMSSMSApi } from "@broadnet/cpaas-sdk";

const sms = new SMSSMSApi(
  new Configuration({
    basePath: "https://api.broadnet.me",
    accessToken: process.env.BROADNET_TOKEN!,
  }),
);

// 1. Generate and store the code (hash it, with an expiry).
const code = String(randomInt(100000, 1000000));
await otpStore.save("447700900123", code, { ttlSeconds: 300 });

// 2. Send it as a normal SMS.
await sms.smsSendsmsPost({
  sMSSmsRequest: {
    senderId: "BroadNet",
    destinationNumber: "447700900123",
    message: `Your verification code is ${code}`,
    messageType: "TEXT",
  },
});

// 3. Later: compare the code the user typed with the stored one.
```

The code is generated and checked in your application; BroadNet delivers it.