Verification codes

Verification codes in WhatsApp. Delivered in seconds, checked for you.

OTP Run generates the code, sends it through WhatsApp in the user's language, falls back to Telegram if WhatsApp does not confirm delivery in time, and checks what the user enters. Codes are never stored in plain text.

Create a free account API reference

The free plan includes one WhatsApp number. No card required.

What you get

Fallback between channels
If WhatsApp does not confirm delivery within a few seconds, the same code goes to Telegram. One code and one check, wherever it was read.
Tap-to-verify
Instead of sending a code, give the user a link: they tap it and send the code to you from their own WhatsApp. No outgoing messages and no risk for your number.
Security built in
Hashed codes, a limit on wrong attempts, expiry, and limits per phone number and IP address against SMS pumping and brute force.

Connect without code

If your app is built on Supabase, there is no code to write: sign-in by phone number moves to WhatsApp with a setting.

An app on Supabase

In OTP Run open your project, then Integrations, then Supabase, and click Create. Copy the hook address.
In Supabase open Authentication, then Hooks, then Send SMS, choose HTTPS and paste the address.
Generate a secret in Supabase, paste it back into OTP Run and save the hook in both places.
Turn on phone sign-in: Authentication, Sign In / Providers, Phone.
The code in your app stays the same. Supabase creates and checks the code, and OTP Run sends it from your WhatsApp number.

Copy the task for Lovable, Cursor or Claude Code

Paste it into the chat of your coding assistant and it adds sign-in by phone number for you. The task is written in English because tools understand it best.

For Lovable and Bolt

Add phone number login with Supabase Auth. Use supabase.auth.signInWithOtp({ phone }) to send the code and supabase.auth.verifyOtp({ phone, token, type: 'sms' }) to check it. Build two screens: a phone input with the country code, and a 6-digit code input with a resend button after 60 seconds. Codes are delivered by a Supabase Send SMS hook that is already configured, so do not add Twilio or any other SMS provider code.

For Cursor, Claude Code and other coding assistants

Add WhatsApp login codes using the OTP Run Verify API. Read https://otprun.com/llms-full.txt first. Work on the server only: POST https://otprun.com/v1/verifications with the header Authorization: Bearer ${OTPRUN_API_KEY} and the body {"to": phone} creates a verification and sends the code; POST https://otprun.com/v1/verifications/{id}/check with {"code": code} checks it, and only status "verified" means success. Keep OTPRUN_API_KEY in server environment variables and never send it to the browser. Create two server routes, /api/otp/start and /api/otp/check, a phone form and a code form. Read the verified phone from GET /v1/verifications/{id} (field to_phone) on the server, then sign the user in with the session mechanism the app already has.

What it looks like in code

Create a verification with the phone number, show a code field, then check what the user typed. The answer is verified, wrong, expired or locked.

Send and check a code

curl -X POST https://otprun.com/v1/verifications \
  -H "Authorization: Bearer $OTPRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"+77010000000","app_name":"Acme"}'

curl -X POST https://otprun.com/v1/verifications/$ID/check \
  -H "Authorization: Bearer $OTPRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"482913"}'

How to start

Create a free account and copy the project API key.
Link a WhatsApp number or use the OTP Run Telegram bot.
Call POST /v1/verifications on sign-up and POST /v1/verifications/{id}/check when the user enters the code.

Questions

How is this cheaper than SMS?

Codes through your linked WhatsApp number and through Telegram have no per-message fee. You pay a flat monthly price instead of a few cents for every SMS.

What if the user does not have WhatsApp?

The routing policy of your project moves on to the next channel, by default Telegram. You can also check numbers in advance with POST /v1/numbers/check.

In which languages are codes sent?

Message templates are built in for 24 languages, and you can write your own text with placeholders for the code, the app name and the expiry time.

How long is a code valid?

Five minutes by default. You can set from 30 seconds to 15 minutes, a code length from 4 to 8 digits and the number of attempts.

More ways to use OTP Run

Link your number and send the first message today.

Free, no card needed. You can unlink the number from your phone at any time.

Link my number free