# Drop-in OTP verification for any app.

- Canonical URL: https://www.broadnet.me/products/myotp
- Language: en
- Last updated: 2026-10-01
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

MyOTP.App · drop-in widget

MyOTP.App is the pre-built verify widget that paste-installs into web and mobile apps. Phone input, code capture, retry, voice fallback and anti-fraud — all on BroadNet's operator-direct OTP routes, all behind one script tag.

[Improve OTP delivery](https://www.broadnet.me/contact?topic=otp-delivery&product=myotp) [Review OTP fraud exposure](https://www.broadnet.me/contact?topic=otp-fraud&product=myotp)

5-minute integration 30+ languages ISO 27001

Delivered in

2.1s

Verified

Verify your number

myotp.app

step 3 / 3

Phone number

+971 50 ••• 4567

Verification code

4

8

2

9

1

2

SMS · arrived 2.1s Resend in 0:24

User verified

token · jwt.eyJhcHAiOiJhcHBfO…

Powered by MyOTP.App

end-to-end signed

Integration

5 min

Paste one script tag and a div

Languages

30+

Localised UI copy out of the box

Label

White

Your sender, your colours, your domain

Uptime SLA

99.99%

Contracted platform availability

From paste to signed JWT

## One script tag, five engineered hops.

The widget is the integration. Underneath, every verification rides BroadNet's OTP-only routes — sub-5s median delivery, HLR pre-validation, and voice fallback already wired in.

1. 01 · Widget Script + div 12kB JS widget mounts on any data-myotp div. Phone input, theme, locale read from data-* attributes. No state machine to write. Mount < 80ms
2. 02 · App ID Verify session Widget calls BroadNet's verification service with your app key. Origin-checked, CORS-pinned, rate-limited per IP and per session. p50 < 60ms
3. 03 · Channel SMS, Telegram or Voice Channel chosen by your account policy. HLR pre-validation kills dead numbers; voice fallback fires if SMS DLR misses the window. p50 < 1.4s
4. 04 · Code User enters Auto-complete from the SMS notification on iOS and Android. Six-digit input, accessible, RTL-aware for Arabic and Hebrew. UX, not latency
5. 05 · Token Signed JWT On verify success, widget hands you a short-lived JWT (5-min default). Verify the signature on your server before granting session. p50 < 30ms
6. ← webhook · server-of-truth JWT verify

01 · Widget

Script + div

12kB JS widget mounts on any data-myotp div. Phone input, theme, locale read from data-* attributes. No state machine to write.

Mount < 80ms

02 · App ID

Verify session

Widget calls BroadNet's verification service with your app key. Origin-checked, CORS-pinned, rate-limited per IP and per session.

p50 < 60ms

03 · Channel

SMS, Telegram or Voice

Channel chosen by your account policy. HLR pre-validation kills dead numbers; voice fallback fires if SMS DLR misses the window.

p50 < 1.4s

04 · Code

User enters

Auto-complete from the SMS notification on iOS and Android. Six-digit input, accessible, RTL-aware for Arabic and Hebrew.

UX, not latency

05 · Token

Signed JWT

On verify success, widget hands you a short-lived JWT (5-min default). Verify the signature on your server before granting session.

p50 < 30ms

What's in the widget

## Six things you don't have to build.

Mount the widget, point it at your app ID, and ship. Everything below is in the box — themed, localised, and wired to the same OTP delivery path the rest of BroadNet's network runs on.

### Drop-in JS widget

A single script tag mounts the entire verify flow — phone input, code capture, retry, voice fallback. No design work, no state machines to wire up.

Bundle

12 kB

Mount

<div>

Themes

Light · Dark

### Native SDKs

First-party SDKs for React, React Native, Flutter, iOS and Android — same verification surface as the web widget, native rendering on every platform.

Web

React

Mobile

iOS · Android

Hybrid

Flutter · RN

### Branded sender

Register an alphanumeric sender ID in regions that allow it; numeric long-codes and short-codes elsewhere. Codes arrive from your name, not a shared shortcode.

Sender ID

Registered

Long-code

Per country

Templates

Per locale

### Voice fallback

If SMS doesn't return a delivery receipt inside your window, the widget escalates to a spoken voice call automatically — same session, same code.

Trigger

<10s

TTS

30+ langs

Cost

Per leg

### Anti-fraud

Velocity caps, geo rules, IP reputation and HLR pre-validation block OTP toll-fraud and signup-pumping before a single message leaves the platform.

Velocity

Per user

Geo

Allow / deny

HLR

Inline

### Analytics dashboard

Verification success, channel mix, drop-off by country and median delivery time — live in the dashboard, exportable to your warehouse.

Realtime

Live

Export

CSV · API

Retention

12 mo

Embed snippet

## Three lines of HTML. One verified user.

The widget self-mounts on any element marked `data-myotp`. On success it returns a short-lived JWT — verify it on your server and start the session.

Framework-agnostic

Works inside React, Vue, Svelte, Rails, Laravel — anywhere you can paste HTML.

Themed automatically

Inherits your colours from CSS variables; ships with light, dark, and brand presets.

No PII in the DOM

Codes and tokens never touch the page state — they live inside the sealed iframe.

index.html

v1 · stable

```
1<!-- 1 · Drop the script on any page2       (the widget script URL is issued with your app_id) -->3<script src="MYOTP_WIDGET_SCRIPT_URL" async></script>4 5<!-- 2 · Mount the verify flow -->6<div7  data-myotp8  data-app-id="app_8f2c9b1e"9  data-locale="en"10  data-theme="light"11  data-on-verified="onUserVerified"12></div>13 14<!-- 3 · Handle the signed result -->15<script>16  function onUserVerified(result) {17    // result.token   — short-lived JWT, verify on your server18    // result.phone   — E.16419    // result.channel — "sms" | "voice"20    fetch("/api/session", {21      method: "POST",22      body: JSON.stringify({ token: result.token }),23    });24  }25</script>
```

Result via callback React · Flutter · iOS · Android SDKs

Customer stories

## Three teams that retired their custom verify flow.

Gulf real-estate developer Real estate · GCC AE

**Challenge**

A bespoke verify flow tied up engineers in ongoing maintenance.

**Approach**

The MyOTP widget replaced the custom UI, with Arabic, English and Russian copy shipped in parallel.

Digital experience lead (reference under NDA)

Southeast Asian fintech platform Fintech · APAC PH

**Challenge**

A large user base used several different OTP UIs across web and mobile with no unified analytics.

**Approach**

A single Flutter SDK plus the web widget standardised verification on iOS, Android and browser.

VP engineering (reference under NDA)

Pan-MENA airline Airline · MENA JO

**Challenge**

Older passengers in peak travel seasons often miss SMS codes, dragging booking conversion.

**Approach**

The widget was deployed with voice-fallback enabled in Arabic on the same checkout session.

Digital product lead (reference under NDA)

Compliance

## Audited for regulated workloads.

Every verification carries an event trail. Retention and residency are configurable per workspace — including MENA-resident options for Gulf-regulated workloads.

ISO 27001

Information security management certified

GDPR-aligned

EU residency and DPA on request

Webhooks

Sent for every verification result

MENA-resident

Gulf data residency for regulated workloads

Questions buyers ask

## MyOTP, answered straight.

On a static page, under 5 minutes from app-ID creation to first verified user — paste the script tag, drop a div, write one callback. On a SPA (React/Vue/Next.js), 15–30 minutes including the SDK install and the JWT verification on your server. Mobile SDKs are a 30–60 minute integration depending on your build setup.

Theme (light/dark/custom CSS variables), brand colour, logo URL, accent colour, font-family, copy for every UI string in every locale, sender ID per country, voice fallback timing, retry policy, and CSS overrides for the modal frame itself. The widget is a Shadow DOM web component — your page CSS never leaks in.

Yes. No 'powered by MyOTP' badge. Your sender ID delivers the code, your domain hosts the iframe (CNAME setup), your logo and brand colours render the modal. The only mention of MyOTP is inside your own dashboard.

30+ at last count: English, Arabic (with full RTL), French, Spanish, Portuguese (PT and BR), German, Italian, Dutch, Polish, Turkish, Russian, Ukrainian, Hindi, Urdu, Bangla, Tamil, Indonesian, Malay, Thai, Vietnamese, Japanese, Korean, Simplified and Traditional Chinese, Hebrew, Greek, Romanian, Czech, Hungarian, Swedish, Norwegian, Danish, Finnish. You can override any string per locale.

Per verified user, with a free tier to evaluate on. Indicative production pricing starts around $0.05/verification on standard sender IDs and drops with volume; high-volume and enterprise tiers are quoted against your country mix and monthly commit. Voice fallback bills separately, per connected call. These figures are illustrative and vary by route — final rates are set in your commercial agreement.

Always. The widget hands the browser a short-lived JWT but also POSTs a webhook to your server with the same verification event. You should treat the client JWT as a hint and the webhook as authoritative — that's the integration pattern in every code sample.

Built-in: per-phone velocity caps, per-IP velocity caps, geo allow/deny, IP reputation gating, HLR pre-validation against ported-out and disconnected numbers, and a destination risk score against known toll-fraud prefixes. All configurable in the dashboard; pumping attacks are blocked before they bill.

Named technical account manager, dedicated app-ID with custom rate-limits, white-label CNAME and custom subdomain, on-prem JWT signing-key rotation, 99.99% widget-availability SLA with automatic credits, and a shared Slack channel with our engineering team for incident response.

Question not here? [Ask our engineering team](https://www.broadnet.me/contact)

Further reading

[Multichannel OTP Verification in 2026: SMS, WhatsApp, Voice and the Fallback That Saves Conversions](https://www.broadnet.me/blog/multichannel-otp-verification-api-2026)

Drop in. Verify. Done.

## Verify your first user before lunch.

Paste one script tag, mount one div, and the widget runs the rest — phone capture, code entry, voice fallback, anti-fraud, analytics. Free tier, no card.

[Improve OTP delivery](https://www.broadnet.me/contact?topic=otp-delivery&product=myotp) [Review OTP fraud exposure](https://www.broadnet.me/contact?topic=otp-fraud&product=myotp)

$ <div data-myotp data-app-id="your_app_id"></div>

## Related guides & answers

Go deeper on the concepts behind this product.

- [What is Flash Call verification Read](https://www.broadnet.me/answers/what-is-flash-call-verification)
- [What is SMS pumping / artificial inflated traffic (AIT) Read](https://www.broadnet.me/answers/what-is-sms-pumping)
- [What is AIT (Artificially Inflated Traffic) Read](https://www.broadnet.me/answers/what-is-ait)
- [What is OTP Read](https://www.broadnet.me/answers/what-is-otp)
- [What is 2FA (two-factor authentication) Read](https://www.broadnet.me/answers/what-is-2fa)
- [How do I build an OTP verification flow Read](https://www.broadnet.me/answers/how-to-build-otp-flow)