Drop-in JS widget
A single script tag mounts the entire verify flow — phone input, code capture, retry, voice fallback. No design work, no state machines to wire up.
Bundle
12 kB
Mount
<div>
Themes
Light · Dark
MyOTP.App · drop-in widget
Drop-in OTP verification for any app.
MyOTP.App is the pre-built verify widget that paste-installs into web and mobile apps. Phone input, code capture, retry, voice fallback and anti-fraud — all on BroadNet's operator-direct OTP routes, all behind one script tag.
5-minute integration 30+ languages ISO 27001
Delivered in
2.1s
Verified
Verify your number
myotp.app
step 3 / 3
Phone number
+971 50 ••• 4567
Verification code
4
8
2
9
1
2
SMS · arrived 2.1sResend in 0:24
User verified
token · jwt.eyJhcHAiOiJhcHBfO…
Powered by MyOTP.App
end-to-end signed
Integration
5 min
Paste one script tag and a div
Languages
30+
Localised UI copy out of the box
Label
White
Your sender, your colours, your domain
Uptime SLA
99.99%
Contracted platform availability
From paste to signed JWT
One script tag,
five engineered hops.
The widget is the integration. Underneath, every verification rides BroadNet's OTP-only routes — sub-5s median delivery, HLR pre-validation, and voice fallback already wired in.
- 01 · WidgetScript + div
12kB JS widget mounts on any data-myotp div. Phone input, theme, locale read from data-* attributes. No state machine to write.
Mount < 80ms - 02 · App IDVerify session
Widget calls BroadNet's verification service with your app key. Origin-checked, CORS-pinned, rate-limited per IP and per session.
p50 < 60ms - 03 · ChannelSMS, Telegram or Voice
Channel chosen by your account policy. HLR pre-validation kills dead numbers; voice fallback fires if SMS DLR misses the window.
p50 < 1.4s - 04 · CodeUser enters
Auto-complete from the SMS notification on iOS and Android. Six-digit input, accessible, RTL-aware for Arabic and Hebrew.
UX, not latency - 05 · TokenSigned JWT
On verify success, widget hands you a short-lived JWT (5-min default). Verify the signature on your server before granting session.
p50 < 30ms - ← webhook · server-of-truth JWT verify
01 · Widget
Script + div
12kB JS widget mounts on any data-myotp div. Phone input, theme, locale read from data-* attributes. No state machine to write.
Mount < 80ms
02 · App ID
Verify session
Widget calls BroadNet's verification service with your app key. Origin-checked, CORS-pinned, rate-limited per IP and per session.
p50 < 60ms
03 · Channel
SMS, Telegram or Voice
Channel chosen by your account policy. HLR pre-validation kills dead numbers; voice fallback fires if SMS DLR misses the window.
p50 < 1.4s
04 · Code
User enters
Auto-complete from the SMS notification on iOS and Android. Six-digit input, accessible, RTL-aware for Arabic and Hebrew.
UX, not latency
05 · Token
Signed JWT
On verify success, widget hands you a short-lived JWT (5-min default). Verify the signature on your server before granting session.
p50 < 30ms
What's in the widget
Six things you don't have to build.
Mount the widget, point it at your app ID, and ship. Everything below is in the box — themed, localised, and wired to the same OTP delivery path the rest of BroadNet's network runs on.
Native SDKs
First-party SDKs for React, React Native, Flutter, iOS and Android — same verification surface as the web widget, native rendering on every platform.
Web
React
Mobile
iOS · Android
Hybrid
Flutter · RN
Branded sender
Register an alphanumeric sender ID in regions that allow it; numeric long-codes and short-codes elsewhere. Codes arrive from your name, not a shared shortcode.
Sender ID
Registered
Long-code
Per country
Templates
Per locale
Voice fallback
If SMS doesn't return a delivery receipt inside your window, the widget escalates to a spoken voice call automatically — same session, same code.
Trigger
<10s
TTS
30+ langs
Cost
Per leg
Anti-fraud
Velocity caps, geo rules, IP reputation and HLR pre-validation block OTP toll-fraud and signup-pumping before a single message leaves the platform.
Velocity
Per user
Geo
Allow / deny
HLR
Inline
Analytics dashboard
Verification success, channel mix, drop-off by country and median delivery time — live in the dashboard, exportable to your warehouse.
Realtime
Live
Export
CSV · API
Retention
12 mo
Embed snippet
Three lines of HTML.
One verified user.
The widget self-mounts on any element marked data-myotp. On success it returns a short-lived JWT — verify it on your server and start the session.
Framework-agnostic
Works inside React, Vue, Svelte, Rails, Laravel — anywhere you can paste HTML.
Themed automatically
Inherits your colours from CSS variables; ships with light, dark, and brand presets.
No PII in the DOM
Codes and tokens never touch the page state — they live inside the sealed iframe.
index.html
v1 · stable
1<!-- 1 · Drop the script on any page2 (the widget script URL is issued with your app_id) -->3<script src="MYOTP_WIDGET_SCRIPT_URL" async></script>4 5<!-- 2 · Mount the verify flow -->6<div7 data-myotp8 data-app-id="app_8f2c9b1e"9 data-locale="en"10 data-theme="light"11 data-on-verified="onUserVerified"12></div>13 14<!-- 3 · Handle the signed result -->15<script>16 function onUserVerified(result) {17 // result.token — short-lived JWT, verify on your server18 // result.phone — E.16419 // result.channel — "sms" | "voice"20 fetch("/api/session", {21 method: "POST",22 body: JSON.stringify({ token: result.token }),23 });24 }25</script>Result via callbackReact · Flutter · iOS · Android SDKs
Customer stories
Three teams that retired
their custom verify flow.
Gulf real-estate developerReal estate · GCC
- Challenge
- A bespoke verify flow tied up engineers in ongoing maintenance.
- Approach
- The MyOTP widget replaced the custom UI, with Arabic, English and Russian copy shipped in parallel.
Digital experience lead (reference under NDA)
Southeast Asian fintech platformFintech · APAC
- Challenge
- A large user base used several different OTP UIs across web and mobile with no unified analytics.
- Approach
- A single Flutter SDK plus the web widget standardised verification on iOS, Android and browser.
VP engineering (reference under NDA)
Pan-MENA airlineAirline · MENA
- Challenge
- Older passengers in peak travel seasons often miss SMS codes, dragging booking conversion.
- Approach
- The widget was deployed with voice-fallback enabled in Arabic on the same checkout session.
Digital product lead (reference under NDA)
Compliance
Audited for regulated workloads.
Every verification carries an event trail. Retention and residency are configurable per workspace — including MENA-resident options for Gulf-regulated workloads.
ISO 27001
Information security management certified
GDPR-aligned
EU residency and DPA on request
Webhooks
Sent for every verification result
MENA-resident
Gulf data residency for regulated workloads
Questions buyers ask
MyOTP,
answered straight.
On a static page, under 5 minutes from app-ID creation to first verified user — paste the script tag, drop a div, write one callback. On a SPA (React/Vue/Next.js), 15–30 minutes including the SDK install and the JWT verification on your server. Mobile SDKs are a 30–60 minute integration depending on your build setup.
Theme (light/dark/custom CSS variables), brand colour, logo URL, accent colour, font-family, copy for every UI string in every locale, sender ID per country, voice fallback timing, retry policy, and CSS overrides for the modal frame itself. The widget is a Shadow DOM web component — your page CSS never leaks in.
Yes. No 'powered by MyOTP' badge. Your sender ID delivers the code, your domain hosts the iframe (CNAME setup), your logo and brand colours render the modal. The only mention of MyOTP is inside your own dashboard.
30+ at last count: English, Arabic (with full RTL), French, Spanish, Portuguese (PT and BR), German, Italian, Dutch, Polish, Turkish, Russian, Ukrainian, Hindi, Urdu, Bangla, Tamil, Indonesian, Malay, Thai, Vietnamese, Japanese, Korean, Simplified and Traditional Chinese, Hebrew, Greek, Romanian, Czech, Hungarian, Swedish, Norwegian, Danish, Finnish. You can override any string per locale.
Per verified user, with a free tier to evaluate on. Indicative production pricing starts around $0.05/verification on standard sender IDs and drops with volume; high-volume and enterprise tiers are quoted against your country mix and monthly commit. Voice fallback bills separately, per connected call. These figures are illustrative and vary by route — final rates are set in your commercial agreement.
Always. The widget hands the browser a short-lived JWT but also POSTs a webhook to your server with the same verification event. You should treat the client JWT as a hint and the webhook as authoritative — that's the integration pattern in every code sample.
Built-in: per-phone velocity caps, per-IP velocity caps, geo allow/deny, IP reputation gating, HLR pre-validation against ported-out and disconnected numbers, and a destination risk score against known toll-fraud prefixes. All configurable in the dashboard; pumping attacks are blocked before they bill.
Named technical account manager, dedicated app-ID with custom rate-limits, white-label CNAME and custom subdomain, on-prem JWT signing-key rotation, 99.99% widget-availability SLA with automatic credits, and a shared Slack channel with our engineering team for incident response.
Question not here? Ask our engineering team
Drop in. Verify. Done.
Verify your first user before lunch.
Paste one script tag, mount one div, and the widget runs the rest — phone capture, code entry, voice fallback, anti-fraud, analytics. Free tier, no card.
$ <div data-myotp data-app-id="your_app_id"></div>
Related guides & answers
Go deeper on the concepts behind this product.