---
title: "Generate OTP"
method: POST
path: "/generate_otp"
---

# Generate OTP

`POST /generate_otp`

## Request

- Base URL: `https://api.myotp.app`
- URL: `https://api.myotp.app/generate_otp`
- Auth: none declared. Required headers: `X-API-Key`

Generate a One Time Password (OTP) and send it to the specified phone number, with optional branding.

## Headers

- `X-API-Key` string, required

## Request body

- object
  - `phone_number` string, required: Phone number to send the OTP to. E.164 format. Include country code without any prefixes.
  - `otp_length` integer: Length of the OTP, defaults to 6. 3 to 8 digits (4 to 8 on Telegram).
  - `otp_validity` integer: Seconds the OTP stays valid, defaults to 300. 30 to 14400 (up to 3600 on Telegram). On WhatsApp the template's expiry applies instead.
  - `channel` 'sms' | 'whatsapp' | 'telegram': Delivery channel for the OTP. Defaults to 'sms'. For WhatsApp, ensure the destination supports WhatsApp Business messaging. Telegram is delivered through the Telegram Gateway API and is charged at a flat rate in every country.
  - `template_order` integer: Order of the template to be used for the OTP message, defaults to 1 (12 for WhatsApp). WhatsApp templates: 12 = English, 5-minute code; 13 = English, 10 minutes; 14 = Spanish (es_MX), 5 minutes; 15 = Spanish (es_MX), 10 minutes. The template's expiry overrides otp_validity on WhatsApp. Requires the ACCESS_TO_TEMPLATES entitlement (Business and Enterprise plans and the free trial).
  - `otp_code` string: Supply your own code instead of letting MyOTP generate one (3 to 8 digits, 4 to 8 for telegram). When set, otp_length is ignored. Use this when another system (for example an identity provider) already holds the code the user must type.
  - `force_send` boolean: If true, forces the sending of OTP even if there is an existing, unexpired OTP for the given phone number.
  - `return_otp` boolean: If true, includes the OTP value in the response. CAUTION: this is not compliant with regulations in many markets.
  - `brand` string: Optional brand name for personalizing the OTP message. 3 to 16 characters, letters, digits and dots. Brand names are screened against a denylist to prevent impersonation. CAUTION: This overrides the account and app defaults.

## Response `200`

OTP successfully generated and sent.

- object
  - `message_id` string: ID of the message sent.
  - `status` 'accepted': Status of the request. Always "accepted" on a 200; delivery state comes from /check_otp_status or a delivery webhook.
  - `message` string: Message describing the status of the request.
  - `date_sent` string, date-time: Date and time the OTP was sent.
  - `expires_at` string, date-time: Date and time the OTP expires.
  - `cost` number, float: Cost of sending the OTP.
  - `otp` string: The OTP value, included if return_otp is true.

## Other responses

- `400`: Bad request due to invalid input parameters.
- `401`: Unauthorized due to missing or invalid API key.
- `403`: Refused. "Insufficient balance" when the balance cannot cover this send (top up, then retry), "User is not active" when the subscription is paused, the calling IP is not on your account's allowlist, or a parameter your plan does not include (otp_length, otp_validity, template_order: Business and Enterprise plans and the free trial).
- `409`: Conflict, OTP already active.
- `429`: Too many requests from this IP address. The edge allows 100 requests a minute per client IP with a burst of 100, counted across every endpoint together, so sends and status checks share one budget. Accounts that ask for more are raised to 500 a minute; X-RateLimit-Limit on every response tells you which ceiling applies to you. Wait the number of seconds in Retry-After and repeat the request. Write to support@myotp.app with the addresses you call from and the peak you are designing for if you need a higher limit.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/myotp/apis/myotpapp-api.md) · [All operations](https://skmtc.dev/myotp/apis/myotpapp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/myotp/apis/myotpapp-api/revisions/95ed911fdece?raw)