Frequently asked questions

Frequently asked questions

What is Octotp?

Octotp is an API service that generates and validates one-time verification codes. You use it when you need to verify a user’s email or phone number with a short code, such as for email verification, two-factor authentication, or password reset.

How do I integrate Octotp?

Sign up, create a project, and get an API key. Call POST /api/tokens to create a code and POST /api/tokens/validate to verify it. Include the X-Api-Key header with your project key. See our API integration guide for full examples.

Is there a free plan?

Yes. The free tier includes 60 tokens per minute, enough for development and small applications. No credit card required.

How long do codes last?

Codes expire after 5 minutes by default. You can override this with the expiresInSeconds parameter when creating a token.

Can I use Octotp for both email and SMS?

Yes. The API accepts either recipientEmail or recipientPhone. You are responsible for delivering the code to the user via your own email or SMS provider.

Are codes secure?

Codes are hashed before storage. The plain code is returned only once when you create the token. Each token can be validated only once.

What are the rate limits?

The free tier allows 60 tokens per minute per API key. Paid plans offer higher limits. Rate limiting is enforced per project.

How do I deliver the code to my user?

Octotp generates the code; you deliver it. Use your existing email service (SendGrid, SES, etc.) or SMS provider (Twilio, etc.) to send the code to the user. The API returns the code in the create response.