Transactional OTP Engine

1. Security Architecture

• Zero Plaintext Storage: OTP codes are hashed with a server-side pepper and SHA-256 before storage in Redis.
• Configurable TTL: Codes automatically expire after a configurable window (default: 600 seconds / 10 minutes).
• Brute-Force Protection: After 5 failed verification attempts, the verification key is permanently tombstoned, preventing any further guess attempts against that session.
• Database Persistence: Every OTP transaction is persisted to PostgreSQL (otp_transactions), ensuring complete auditability on the /activity feed.

2. Dispatching an OTP (POST /api/v1/otp/send)

curl -X POST "https://api.sendrin.com/api/v1/otp/send" \
-H "Authorization: Bearer sendrin_a1b2c3d4e5f6.xY7z..." \
-H "Content-Type: application/json" \
-d '{
  "channel": "email",
  "recipient_email": "[email protected]",
  "purpose": "login",
  "code_length": 6,
  "ttl_seconds": 600
}'

{
"otp_id": "otp_01HXYZ3344556677889900AABB",
"status": "sent",
"channel": "email",
"expires_at": "2026-09-16T02:10:00Z",
"ttl_seconds": 600,
"purpose": "login",
"remaining_credits": 948
}

3. Verifying an OTP (POST /api/v1/otp/verify)

When the user submits the code on your application, verify it against Sendrin:

curl -X POST "https://api.sendrin.com/api/v1/otp/verify" \
-H "Authorization: Bearer sendrin_a1b2c3d4e5f6.xY7z..." \
-H "Content-Type: application/json" \
-d '{
  "channel": "email",
  "recipient_email": "[email protected]",
  "code": "482910",
  "purpose": "login"
}'

{
"verified": true,
"message": "Code verified successfully.",
"verification_token": "vtok_ccfed7ca0edeb77ece1842d833c4a9b1c2bb5ed8a39f2960637ac30a49f8c977",
"verified_at": "2026-09-26T18:58:09Z",
"remaining_attempts": null
}

4. SMS Channel OTP

To dispatch an OTP via SMS, set channel: "sms" and provide recipient_phone in E.164 format:

curl -X POST "https://api.sendrin.com/api/v1/otp/send" \
  -H "Authorization: Bearer sendrin_a1b2c3d4e5f6.xY7z..." \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "sms",
    "recipient_phone": "+14155552671",
    "purpose": "transaction_confirm",
    "code_length": 6
  }'