SMS OTP API

SMS OTP API for Africa

Send and verify one-time passcodes across Nigeria, Kenya, Ghana, South Africa, the UK, Benin, Ivory Coast, and the US with multi-provider failover, configurable code length and expiry, and per-phone rate limits — on the same API and prepaid credits as transactional SMS.

Start Free Trial Read Docs

An OTP SMS API lets your application verify a user's phone number by sending a one-time passcode over SMS and confirming the code they type back. It is the backbone of phone-based signup, two-factor authentication, password reset, and transaction confirmation — proving a user controls the number before you trust it.

Robase handles the hard parts of OTP delivery in Africa. Two endpoints — /v1/otp/send and /v1/otp/verify — generate the code, deliver it across Nigeria, Kenya, Ghana, South Africa, the UK, Benin, Ivory Coast, and the US with multi-carrier failover, enforce expiry, and rate-limit abuse. You never store codes or manage carriers, and you pay per code from ₦6 with prepaid credits.

Verify a phone number in two calls

Send a code, then verify what the user entered. Robase manages the code and its expiry in between.

1. Send a code

curl -X POST https://api.robase.dev/v1/otp/send \
  -H "Authorization: Bearer robe_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "phone_number": "+2348012345678",
    "code_length": 6,
    "ttl_seconds": 600
  }'
{
  "otp_id": "otp_8f3c...",
  "status": "sent",
  "credit_cost": 1
}

2. Verify the code

curl -X POST https://api.robase.dev/v1/otp/verify \
  -H "Authorization: Bearer robe_xxx" \
  -H "Content-Type: application/json" \
  -d '{ "otp_id": "otp_8f3c...", "code": "123456" }'
{
  "verified": true,
  "status": "approved"
}

The same flow in your language

Node

import { Robase } from "@robasedev/sdk";

const robase = new Robase({ apiKey: "robe_xxx" });
const sent = await robase.otp.send({
  phone_number: "+2348012345678",
  code_length: 6,
});
await robase.otp.verify({ otp_id: sent.id, code: "123456" });

PHP

$robase = new Robase\Client("robe_xxx");

$sent = $robase->otp->send("+2348012345678", codeLength: 6);
$robase->otp->verify($sent->id, "123456");

A Go SDK is available too — install commands and quickstarts for all three are in the SDK docs.

Why build on the Robase OTP SMS API

Send & verify in two calls

POST /v1/otp/send delivers the code; POST /v1/otp/verify checks it. Robase generates, stores, and expires codes for you — no verification state to manage.

Multi-provider failover

Published African routes use a primary plus fallback upstream. If the primary is down, the code is retried on the fallback in the same request.

Configurable length & expiry

Choose 4 to 8 digit codes and a TTL of up to one hour per request, matching the security and UX of each flow.

Anti-abuse rate limits

Per-phone and per-API-key rate limits stop SMS-pumping fraud and runaway costs before they reach your bill.

Prepaid credits from ₦6

Pay only for codes you send. Verification is free. No monthly fee, no minimum, and credits never expire.

One API for OTP + SMS

The same credentials, routing, and credits also power the transactional SMS API. Integrate once.

Coverage & pricing

One prepaid credit = ₦6. Each OTP costs credits based on the destination country; verification is free. Credits never expire and cover both OTP and transactional SMS.

CountryCodeCredits / OTPExample price
NigeriaNG1₦6
KenyaKE3₦18
GhanaGH3₦18
South AfricaZA4₦24
United KingdomGB8₦48
BeninBJ56₦336
Ivory CoastCI79₦474
United StatesUS50₦300

See the full pricing breakdown or the SMS API for Nigeria & Africa.

Deliverability & security

OTPs are time-critical: a code that arrives late — or not at all — is a failed login and a lost user. Robase routes every code over high-priority transactional routes with multi-carrier failover per country, so a temporary outage on one carrier does not lock your users out.

On the security side, per-phone and per-API-key rate limits defend against SMS-pumping fraud — where attackers trigger floods of codes to premium numbers — while short, configurable expiry windows keep codes from lingering. Robase respects carrier-level do-not-disturb and opt-out rules so your verification traffic stays compliant across markets.

Built for verification flows

Login & 2FA

Add a second factor to logins with a passcode users type back in.

Signup verification

Confirm a real phone number before creating an account.

Password reset

Verify ownership before letting a user change credentials.

Transaction confirmation

Require a code to authorize payments and sensitive actions.

Step-up authentication

Challenge a code only when a request looks risky.

Device enrollment

Verify a new device before trusting it on the account.

OTP SMS API FAQ

What is an OTP SMS API?

An OTP SMS API is a REST endpoint that sends a one-time passcode over SMS and verifies the code the user types back. Robase gives you two endpoints — POST /v1/otp/send and POST /v1/otp/verify — that handle code generation, delivery across Nigeria, Kenya, Ghana, South Africa, the UK, Benin, Ivory Coast, and the US, expiry, and rate limiting for you.

How do I verify a code?

POST the phone number to /v1/otp/send. Robase generates and delivers the code and returns an otp_id. When the user enters the code, POST that otp_id and the code to /v1/otp/verify, and Robase tells you whether it matches and is still valid.

Can I set the code length and expiry?

Yes. Codes can be 4 to 8 digits with a time-to-live of up to one hour. You choose the length and TTL per request, so the same API works for a quick login code or a longer-lived confirmation.

How is OTP billed?

With the same prepaid credits as transactional SMS. 1 credit = ₦6, and each OTP costs credits based on the destination country — from 1 credit (₦6) in Nigeria. No monthly fee, no minimum, and credits never expire. Verification calls are free.

How does delivery routing work?

On Nigeria, Kenya, Ghana, and South Africa, Robase sends via a primary upstream and retries a fallback if that provider fails. The UK and US routes are currently single-provider. You never manage carriers yourself.

How do you prevent abuse?

Per-phone-number and per-API-key rate limits cap how many codes can be requested in a window, protecting you from SMS-pumping fraud and runaway costs. Idempotent send semantics make retries safe.

Is it the same API as transactional SMS?

Yes. One integration, one set of credentials, and one credit balance cover both the SMS OTP API and the transactional SMS API — the same routing, failover, and billing.

Which countries are supported?

Robase delivers OTPs to the eight published priced markets: Nigeria, Kenya, Ghana, South Africa, the UK, Benin, Ivory Coast, and the US. NG/KE/GH/ZA/BJ/CI have multi-provider failover; GB and US are currently single-provider.

Keep reading

Get Free Trial Credits — No Card Needed

Last updated: July 6, 2026