--- title: "One-time passwords" description: "Verify phone-number control with SMS codes and verdict-based checks." canonical: "https://studio.inttegro.com/products/otps" format: inttegro-machine-docs/v1 language: "PHP" sdk_version: "v12.0.0" reader_profile: optional reader_manifest: "https://studio.inttegro.com/machine/php/readers/index.json" reader_identification: "Optional: declare your client only if known and your current-session capabilities; use reader_manifest for supplemental recommendations." preamble_estimated_tokens: 368 model_token_report: "https://studio.inttegro.com/machine/token-report.json" preamble_questions: 5 preamble_source: "general" recommended_mcp_tools: [] estimated_tokens: 1595 token_estimate_method: "utf8_bytes_divided_by_4" --- ## Machine preamble **Summary:** Verify phone-number control with SMS codes and verdict-based checks. This PHP representation uses the selected SDK's native names wherever Studio has a verified mapping. ### Five questions #### Q1. When should the reader use One-time passwords? Use this product guide to understand behavior, boundaries, and lifecycle before choosing API operations. #### Q2. What is authoritative on this page? This page is authoritative for product behavior and lifecycle intent. Linked API references define exact operations and data shapes. #### Q3. What page-specific constraint matters most? Keep product behavior separate from transport details and confirm current capabilities before hard-coding market or lifecycle assumptions. #### Q4. Can Inttegro MCP materially help with this task? No catalog ability is sufficiently specific to recommend for this page. Use the documentation directly; consult the MCP catalog only if the task later requires governed live account context or a supported operation. #### Q5. How should the reader verify the answer and continue? Confirm the chosen behavior against the linked guide and API operation, then verify the resulting resource state rather than relying only on UI presentation. Continue with [Chimes](https://studio.inttegro.com/machine/php/products/chimes.md) and [Verify users with OTP](https://studio.inttegro.com/machine/php/guides/verify-with-otp.md) when those concerns enter scope. ## Document content # One-time passwords One-time passwords let you check that a customer controls a phone number before you continue a sensitive flow. Inttegro generates a short-lived SMS code, sends it to the recipient, and records the verification attempt. > **Note:** > > The MCP tool catalog does not currently expose OTP initiation or verification. Keep OTP submission and verdict checks in your trusted backend; use MCP only for adjacent customer or order investigation when that context is relevant. Use this page to understand the OTP boundary. Use the [OTP API reference](https://studio.inttegro.com/machine/php/api/otps.md) for exact request attributes and response shapes. ## What OTPs are for Use OTPs for explicit phone-control checks: - customer sign-in or sign-up; - phone-number confirmation; - sensitive account changes; - high-risk action approval; and - recovery flows where SMS verification is appropriate. Do not use Chimes as an OTP substitute. Chimes are notifications; OTPs have a verification endpoint and a verdict-bearing response. ## Verification model An OTP transaction represents one generated code and its delivery/verification lifecycle. | Step | What happens | | --- | --- | | Initiate | Your backend requests a code for a recipient and service name. | | Deliver | Inttegro sends the code by SMS, synchronously or asynchronously depending on request options. | | Collect | Your application asks the customer to enter the code. | | Verify | Your backend submits the transaction ID, recipient, and customer-entered token. | | Decide | Your application continues only when the verification verdict is `pass`. | An HTTP 200 from verification means the attempt was recorded. It does not by itself mean the submitted token was correct. Authorize only from `verification_attempt.result.verdict: "pass"`. ## Initiation rules The fields most integrations need are: - `recipient` - international phone number; - `service_name` - customer-facing service label; - `token_size` - code length from 5 through 10; - `token_alphabet_type` - optional alphabet, such as numeric or alphanumeric; - `validity_duration_in_minutes` - optional expiry window; and - `async_delivery` - optional delivery mode when your integration can handle delayed transmission details. Keep the service name recognizable. Customers should understand which product requested the code. ## Security and UX rules Build the surrounding flow deliberately. - Store the OTP transaction ID server-side with the pending action. - Never log submitted tokens. - Never expose generated tokens in your own application. - Rate-limit initiation and verification attempts. - Show clear expiry and resend behavior. - Treat delivery status as delivery telemetry, not as proof of verification. ## Implement verification Use [Initiate OTP transaction](https://studio.inttegro.com/machine/php/api/otps.md#initiate-otp-transaction) to start the flow and [Verify OTP](https://studio.inttegro.com/machine/php/api/otps.md#verify-otp) to submit the customer-entered code. Use [Lookup OTP transaction](https://studio.inttegro.com/machine/php/api/otps.md#lookup-otp-transaction) when you need state refresh. If the protected flow is abandoned, stop accepting that OTP transaction in your own application state. The maintained walkthrough is [Verify users with OTP](https://studio.inttegro.com/machine/php/guides/verify-with-otp.md#verify-the-submitted-token). It shows the verdict check your application must perform. ## Related resources - [OTP API reference](https://studio.inttegro.com/machine/php/api/otps.md) - Exact OTP transaction contract. - [Verify users with OTP](https://studio.inttegro.com/machine/php/guides/verify-with-otp.md) - End-to-end task guide. - [Initiate OTP transaction](https://studio.inttegro.com/machine/php/api/otps.md#initiate-otp-transaction) - Start a verification flow. - [Verify OTP](https://studio.inttegro.com/machine/php/api/otps.md#verify-otp) - Submit the customer-entered code. - [Chimes](https://studio.inttegro.com/machine/php/products/chimes.md) - Customer notifications that are not authentication flows.