Mobile OTP Verification API for Secure Customer Onboarding

The OTP stays valid until the otp_expiry_timestamp returned by Send OTP. The verification token issued by Verify OTP is valid for 5 minutes from generation.

Yes. By default OTPs are sent with the Eko India signature. To use your own Sender ID and template, register as a Principal Entity on a telecom DLT platform, register a Sender ID and the OTP content template, and share the approved details during onboarding.

You are billed per OTP sent. Verify OTP and Validate Token are free follow-up calls.

Four steps: sign up at the developer console page, verify your identity with PAN and address details, load your wallet to test the APIs live, then integrate and go live. Sandbox credentials are issued immediately — you can call your first endpoint before any paperwork clears.

EPS (Eko Platform Services) is the technology arm of Eko — the developer tools, AI tooling and APIs that power modern fintech integration, from money transfer and AePS to identity verification.

Three paths, pick whichever suits your stack:

• Call the REST APIs directly.
• Use our official JavaScript / PHP SDKs to skip request-signing boilerplate.
• Let an AI coding agent build it via our MCP server and agent skills.

For multi-step flows (onboard a sender, then transfer) start from a transaction-flow recipe rather than wiring single endpoints together yourself.

Each request carries your static developer_key header plus a per-request secret-key header — an HMAC-SHA256 signature of the current timestamp, keyed by your access key. The access key itself is never sent over the wire. You receive UAT keys on signup and production keys after KYC.

The How Authentication Works guide has the full signing recipe in five languages plus an in-browser playground that generates and verifies a real secret-key against your own access key.

Yes. A full sandbox is available immediately on signup — test your integration end-to-end before going live, no commitment required. For offline work you can also run our mock server (npx -y @ekoindia/eps-mock-server) and get canned responses with no network calls at all.

Sandbox and production share the same paths and differ only by base URL:

• UAT / Sandbox — https://staging.eko.in/ekoapi/v3
• Production — https://api.eko.in/ekoicici/v3

A common cause of failures is calling the sandbox URL with live credentials, or vice-versa — make sure the base URL matches the keys you are using.

Production API access may require your static public (server) IP to be whitelisted. If your calls work from Postman but fail or time out from your own server, that is almost always the cause — share your static public IP with us so we can whitelist it.

Yes — that is the fastest path. Point your agent (Claude Code, Codex, Cursor, Copilot, …) at our MCP server and it can look up any endpoint, generate correctly-signed requests, and scaffold the integration in your own stack. Install it in one step from the AI hub, or start from a ready-made prompt.

We also publish an OpenAPI 3.1 spec, a Postman collection and per-agent context packs (AGENTS.md, CLAUDE.md, .cursorrules) so an agent has the ground truth instead of guessing.

Most verification APIs return in real time with sub-second responses, and 99th-percentile latency stays under two seconds across verification endpoints. Transaction APIs (DMT, AePS, BBPS) respond within seconds.

Yes. The API is designed to handle large-scale volumes reliably without performance degradation.

Usage is billed per successful API call with no minimum commitment. Volume-based pricing tiers are available — see the pricing calculator for indicative rates, or contact our team for a custom quote.