Send a code

Makes an OTP and sends it by the first channel that can take it.

Body#

Codes that fill in themselves#

Phones can take the code out of the SMS and offer it in your app or on your website, so people don't type it. How depends on the text, so it takes an sms_template of your own, or a template:

• iPhone, iPad and Mac offer any code they find in a message. End the text with the line @yourdomain.com #{code} and the code is offered only on that website and in the apps linked to it, which keeps it out of phishing sites. Chrome on Android reads the same line for websites.
• Android apps read the code themselves with Google's SMS Retriever API when the text holds the app's 11-character hash and is at most 140 bytes: one SMS of plain text. Take the hash from the app as Google Play signs it, since Play's signing changes it. Without the hash, Android's SMS User Consent API asks the person to share the message instead.

Your Acme code is {code}. FA+9qCX9VSu

@acme.example #{code}

The domain line must be the last line. A domain in your text is checked like any link, against public phishing lists and your content rules.

Response#

201 Created with the OTP object, once the first channel has taken the code.

{
  "id": "7c1e0b52-9d2f-7a41-8e33-52d0f1c7ab90",
  "to": "+447700900123",
  "status": "sent",
  "channel": "telegram",
  "channels": ["telegram", "sms"],
  "telegram_status": "sent",
  "price_micros": 15000,
  "checks_left": 5,
  "payload": "signup-4821",
  "expires_at": "2026-11-02T09:25:02.123456Z",
  "created_at": "2026-11-02T09:15:02.123456Z"
}

Errors#