---
title: "Verify a door code"
method: POST
path: "/v1/otp/verify"
---

# Verify a door code

`POST /v1/otp/verify`

## Request

- Base URL: `https://api.affix-io.com`
- URL: `https://api.affix-io.com/v1/otp/verify`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Verify and consume a six-digit door code. A code works once. Returns 409 used if its proof has already been spent.

## Request body

- object
  - `otp` string
  - `proof_digest` string: Optional. When given, the code must belong to this proof.

## Response `200`

Valid. allow is true.

- CarrierVerifyResponse
  - `allow` boolean
  - `reason_code` string: VALID when allowed. Otherwise e.g. used, expired, not_found.
  - `spent` boolean: True once the bound proof has been consumed at a gate or the carrier was consumed.
  - `carrier` object
  - `policy_version` string

## Other responses

- `400`: Not valid (expired, not_found, invalid).
- `401`: API key missing or not accepted.
- `409`: used: the carrier or its bound proof has already been spent.

---

[API](https://skmtc.dev/affix-io/apis/affixio-verification-api.md) · [All operations](https://skmtc.dev/affix-io/apis/affixio-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/affix-io/apis/affixio-verification-api/revisions/9a5f8ff2582d?raw)