OTP & verification

One-time passcodes (OTP) can be sent two ways, depending on the channel.

OTP over SMS — you own the code

For SMS, you generate and verify the code yourself. Send it like any other SMS through POST /messages, but set isOtp: true so the platform treats the traffic as sensitive:

POST https://client.routeon.io/api/v1/messages
X-API-Key: <API_KEY>

{
  "contact": "905063565285",
  "channel": 1,
  "senderId": "Routeon",
  "payload": { "text": "Your code is 4821" },
  "isOtp": true
}
  • isOtp: true marks the message as one-time-password traffic, so the body is masked in logs and reports.
  • Your application creates the code, stores it (hashed, with an expiry) and checks what the user typed against it. The platform does not verify SMS codes for you.
  • Track delivery the usual way — messageStatus webhook or GET /edrs (see Track delivery).

Server-side verification — Telegram Gateway

The Telegram Gateway channel (channel: 8) is the one flow where the platform generates and verifies the code for you. It has dedicated endpoints:

  1. POST /messages with channel: 8 and a payload describing the code (e.g. code_length, ttl). The platform generates the OTP, delivers it via Telegram, and returns a messageId.
  2. The user enters the code in your app.
  3. POST /messages/verification with the messageId and the code the user typed. The platform returns a verification_status:
verification_status Meaning
code_valid The code matches — verification succeeded.
code_invalid The code does not match.
expired The code’s time-to-live has passed.
revoked The code was invalidated before use.
  1. Optionally, POST /messages/revoke invalidates the original code early (for example if the user restarts the flow).
POST /messages (channel:8, payload:{code_length:5, ttl:300})  → 202 {messageId}
        ↓ user enters code
POST /messages/verification {messageId, code}                 → 200 {verification_status:"code_valid"}

Choosing an approach

Goal Use
Send a numeric code over SMS and verify it in your own backend POST /messages with isOtp: true
Have the platform generate and check the code Telegram Gateway (channel: 8) → POST /messages/verification