/otp/sendSend OTP
Generates a 6-digit OTP, stores a salted hash in Redis (TTL 5 minutes), and delivers via SMS or email.
Middleware: validateAppApiKey → validateApprovedBrand → checkOtpSendCooldown (SMS only) → rateLimitOtpSend → global rate limit.
Rate limits (send/resend only):
- Global: 10 requests/minute per appId (or apiKey / IP fallback)
- Per phone: 3/minute, 10/hour
Cooldown (SMS only): Redis key blocks rapid resends after successful SMS send.
SMS delivery: When OTP_DLT_ENABLED=true and the brand has otpPolicy.dltEnabled: true
in brand-registry.json, OTP SMS uses Fast2SMS route=dlt (e.g. LOGIN_OTP with registry brandName).
brandId is required on all OTP endpoints. OTP hashes in Redis are scoped per brandId + recipient.
OTP templates (LOGIN_OTP, LOGIN_OTP_WITH_ID): Use this endpoint only — not POST /notify.
See /docs/api/otp for full narrative.
operationId: otpSend
Related documentation
Request
Requires appId and apiKey in the JSON body.
Schemas: SMS (default channel) — ApnaKart LOGIN_OTP via DLT, SMS — LOGIN_OTP_WITH_ID (optional loginId), EMAIL channel
SMS (default channel) — ApnaKart LOGIN_OTP via DLT
{
"appId": "ELVA_NOTIFY",
"apiKey": "shared-platform-api-key",
"brandId": "enandi",
"phone": "918660397320"
}SMS — LOGIN_OTP_WITH_ID (optional loginId)
{
"appId": "ELVA_NOTIFY",
"apiKey": "shared-platform-api-key",
"brandId": "enandi",
"phone": "918660397320",
"loginId": "user_7488"
}EMAIL channel
{
"appId": "ELVA_NOTIFY",
"apiKey": "shared-platform-api-key",
"brandId": "enandi",
"channel": "EMAIL",
"email": "user@example.com"
}