PUTVerify OTP

Verify the OTP entered by the customer and receive a signed verification token for downstream use.

PUT/tools/kyc/mobile/otp/verify

Validates the OTP sent by the Send OTP API. On success (status = 0) it returns a signed JWT otp_verification_token containing the verified mobile and a unique token id. The token is valid for 5 minutes and acts as proof that OTP verification was performed — pass it to any transaction that depends on a verified mobile, and use the Validate OTP-Verification-Token API to confirm its authenticity.

Request

Body parameters

Field	Type	Required	Description
`initiator_id`	string	required	Registered mobile number of the API user (see Platform Credentials).e.g. 9962981729
`client_ref_id`	string	optional	Unique reference ID per API call, generated by your system (max 20 characters).e.g. 2026010100123456789
`otp`OTP	string	required	The OTP value the customer received via SMS from the Send OTP API.e.g. 3643
`mobile`Mobile Number	string	required	The same 10-digit mobile number the OTP was sent to.e.g. 9002336768

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference ID per API call, generated by your system (max 20 characters).

example: 2026010100123456789

otpstringRequired· OTP

The OTP value the customer received via SMS from the Send OTP API.

example: 3643

mobilestringRequired· Mobile Number

The same 10-digit mobile number the OTP was sent to.

example: 9002336768

These headers authenticate and sign every request. See How Auth Works for details.

Field	Type	Required	Description
`developer_key`	string	required	Static API key issued to your account after KYC.
`secret-key`	string	required	Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).
`secret-key-timestamp`	string	required	Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.
`content-type`	string	required	application/jsone.g. application/json

developer_keystringRequired

Static API key issued to your account after KYC.

secret-keystringRequired

Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).

secret-key-timestampstringRequired

Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.

content-typestringRequired

application/json

example: application/json

Responses

statusnumber
Primary success indicator (0 = success).
messagestring
Human-readable response / error message.
response_status_idnumber
Granular status id; see the shared error-codes table.
response_type_idnumber
A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.
dataobject
API-specific response payload.
- client_ref_idstring
  Unique reference id for this OTP flow, echoed back.
- otp_verification_tokenstring
  Signed JWT proving the OTP was verified. Contains the verified mobile and a unique token id; valid for 5 minutes. Validate it with the Validate OTP-Verification-Token API.
- initiator_idstring
  Registered mobile number of the API user that initiated the call.
- mobilestring
  The mobile number that was verified.
- tidstring
  Unique transaction id for this verification.

Next steps

NextGETValidate OTP-Verification-TokenValidate an otp_verification_token as proof that OTP verification happened within the 5-minute time limit.

Request

Body parameters

Responses

Next steps

Related