← Back to blog
Authentication · 2026-07-18

OTP API in India: how to add phone OTP verification (with examples)

9 min readby QuickAuth

An OTP API is the fastest way to add phone-number verification to an app without building — and babysitting — your own SMS and WhatsApp infrastructure. You call one endpoint to send a one-time code and another to verify it; the provider handles code generation, delivery, expiry, retries and fraud protection. This guide covers how an OTP API works, a minimal integration, and the India-specific details — DLT, WhatsApp OTP, auto-read and anti-fraud — that actually decide your delivery rate.

What an OTP API actually does

Under the hood a one-time password API exposes two operations. A send call takes a phone number and a channel and dispatches a short numeric code. A verify call takes that number and the code the user typed and returns whether it matches and is still valid. Everything else — generating the code, choosing a route, enforcing a 5-minute expiry, throttling repeat requests — is the provider’s job, not yours.

A typical send-and-verify pair looks like this:

# 1. Send the code
POST /v1/otp/send
{ "phone": "+919876543210", "channel": "auto" }
→ { "id": "otp_9f2ab1c", "channel": "whatsapp", "status": "sent" }

# 2. Verify what the user typed
POST /v1/otp/verify
{ "phone": "+919876543210", "code": "482913" }
→ { "verified": true }

That is the whole contract. Your backend never stores the code, never talks to a telecom, and never manages templates — see the quickstart for the copy-paste version in your language.

Choose the channel: SMS, WhatsApp or voice

The channel you pick is the single biggest lever on cost and delivery in India:

  • WhatsApp OTP — cheapest, highest-converting, and outside DLT. The code lands in the user’s WhatsApp chat and our SDK auto-reads it. Best default for consumer apps where most users have WhatsApp.
  • SMS OTP — universal reach, works on every phone, but needs DLT-registered headers and templates and costs more per message.
  • Voice OTP — a spoken code as a last resort when both SMS and WhatsApp fail, useful for hard-to-reach numbers.

The strongest setup is WhatsApp-first with automatic SMS fallback: try the cheap, fast channel, and only fall back to SMS when WhatsApp doesn’t deliver. We break the fallback ladder down in WhatsApp-first OTP with automatic SMS fallback.

Auto-read: don’t make users type the code

Every extra second at the OTP screen costs you signups. A good OTP API pairs with SDKs that read the code automatically:

  • Android uses the SMS Retriever API — permission-free autofill, no “allow this app to read messages” prompt. It hinges on an 11-character app hash in the message; we cover it in the app-hash guide.
  • iOS uses the oneTimeCode content type so the keyboard suggests the code from the notification.
  • WhatsApp codes are auto-read by our SDK on both platforms.

The India specifics that decide delivery

A generic global OTP API will disappoint you in India. Three local realities matter:

  • DLT registration. TRAI requires every SMS sender, header and template to be enrolled on DLT. A provider that handles this for you — entity, sender ID and template approvals — saves weeks. See the DLT registration guide.
  • SMS-pumping (AIT) fraud. Attackers trigger mass OTP sends to premium ranges to skim revenue. Your OTP API should block it at the request step with prefix scoring, velocity heuristics and per-IP/device quotas — before any code fires and any cost is incurred.
  • INR billing and direct routes. Direct operator SMS routes and INR invoicing beat paying a global vendor in USD on aggregated routes.

A quick integration checklist

  • Call send with the user’s phone and channel: "auto".
  • Show the OTP screen; let the SDK auto-read where possible.
  • Call verify with the code; gate the session on verified: true.
  • Rate-limit resends and rely on the provider’s anti-fraud layer.
  • Keep WhatsApp as the primary channel and SMS as the fallback.

Getting started

If you’re adding phone verification to an Indian app, start with the QuickAuth OTP API — WhatsApp, SMS and voice on one endpoint, auto-read on Android and iOS, DLT handled for you and SMS-pumping protection built in. The quickstart gets a working OTP flow running in about five minutes, and you can apply for access to get an INR quote for your volume.