/Introduction

Get started

Introduction

OTPRelay is OTP delivery for the Gulf, exposed as two APIs on one delivery layer. Send a code you generated and OTPRelay just delivers it - you verify it yourself - or let OTPRelay generate, send, and check it. Either way, codes go out from a single trusted sender, over multiple routes with automatic operator failover. Starting in the Gulf, expanding worldwide by demand.

OTPRelay does one job well: get a one-time passcode to the handset by SMS across the Gulf. The shared layer underneath is delivery - a pre-cleared OTPRelay sender, multiple routes into the destination country with automatic operator failover, and SMS-pumping protection on by default. On top of that you pick how much of the lifecycle you want to own.

The Send API (POST /v1/messages) delivers a code you already generated. POST the number and the code; OTPRelay wraps it in the pre-cleared OTP template, delivers it, and returns delivery status - you verify the code on your side. The Verify API (POST /v1/verifications) is fully managed: OTPRelay generates the code, sends it, then checks the code the user typed across two calls. Same API key, same delivery, same flat price - switch modes any time.

If you've used Twilio Verify, the managed mode will feel familiar - the same two-step send then checkmodel - but there's nothing to register, or skip the managed verify entirely and use just delivery. OTPRelay did the telecom and compliance work once, for everyone: no sender-ID filing, no per-country paperwork, no waiting. Saudi Arabia is live, the rest of the GCC is next, and more regions follow demand.

Two APIs, one delivery layer

The Send API is one call: you own generation, attempts, and expiry, and OTPRelay owns delivery - routing, operator failover, the pre-cleared sender, and fraud protection. The Verify API is two calls: send a code to a phone number, then check the code the user entered, with OTPRelay owning the full lifecycle in between - code generation, SMS delivery, route and operator failover, attempts and expiry.

The whole integration
# 1. Send the passcodecurl https://api.otprelay.io/v1/verifications \  -H "Authorization: Bearer sk_live_••••" \  -H "Content-Type: application/json" \  -d '{ "to": "+966512345678" }' # 2. Check the code the user typedcurl https://api.otprelay.io/v1/verifications/check \  -H "Authorization: Bearer sk_live_••••" \  -H "Content-Type: application/json" \  -d '{ "to": "+966512345678", "code": "418207" }'

What OTPRelay handles for you

  • No registration - you never file a sender ID or per-country telecom paperwork. OTPRelay did the compliance work once, for everyone. See GCC compliance & coverage.
  • One trusted sender - every code arrives from OTPRelay, with your company name in the message body. See Sender & message.
  • Multiple delivery routes with continuous route-health scoring.
  • Automatic SMS route & operator failover - see Delivery & failover.
  • Fraud & SMS-pumping protection - see Rate limits & fraud.
  • Delivery & completion analytics and webhooks for every event.

Base URL & format

The API is organised around REST, uses JSON request and response bodies, and authenticates with bearer API keys. All requests go to:

text
https://api.otprelay.io/v1

Response fields are snake_case. Resource IDs are prefixed - a message is msg_…, a verification is ver_…, an attempt is att_…. Phone numbers are always E.164 (e.g. +966512345678).

Where to next

One delivery layer, two modes

OTPRelay is the OTP primitive for the Gulf: deliver a code you generated, or generate and verify one for you - both on the same delivery layer. There's no platform to adopt and no sender to register - start with the Quickstart.