Transactional OTP Engine

1. Security Architecture

• Zero Plaintext Storage: OTP codes are hashed with a server-side pepper and SHA-256 before storage in Redis.
• Configurable TTL: Codes automatically expire after a configurable window (default: 600 seconds / 10 minutes).
• Brute-Force Protection: After 5 failed verification attempts, the verification key is permanently tombstoned, preventing any further guess attempts against that session.
• Database Persistence: Every OTP transaction is persisted to PostgreSQL (otp_transactions), ensuring complete auditability on the /activity feed.

2. Dispatching an OTP (POST /api/v1/otp/send)

curl -X POST "https://api.gns.iitdeveloper.com/api/v1/otp/send" \
-H "Authorization: Bearer gns_live_sk_..." \
-H "Content-Type: application/json" \
-d '{
  "channel": "email",
  "recipient_email": "user@example.com",
  "purpose": "login",
  "code_length": 6,
  "ttl_seconds": 600
}'

3. Verifying an OTP (POST /api/v1/otp/verify)

When the user submits the code on your application, verify it against Sendrin:

curl -X POST "https://api.gns.iitdeveloper.com/api/v1/otp/verify" \
-H "Authorization: Bearer gns_live_sk_..." \
-H "Content-Type: application/json" \
-d '{
  "channel": "email",
  "recipient_email": "user@example.com",
  "code": "482910",
  "purpose": "login"
}'

4. SMS Channel OTP

To dispatch an OTP via SMS, set channel: "sms" and provide recipient_phone in E.164 format:

curl -X POST "https://api.gns.iitdeveloper.com/api/v1/otp/send" \
  -H "Authorization: Bearer gns_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "sms",
    "recipient_phone": "+14155552671",
    "purpose": "transaction_confirm",
    "code_length": 6
  }'