Get started

Authentication

OTPRelay authenticates every request with a bearer API key. Keep live keys secret, and use test keys while you build.

Pass your API key in the Authorization header as a bearer token. All requests must be made over HTTPS - calls over plain HTTP fail, and requests without a valid key return 401.

Authorization header

Authorization: Bearer sk_live_51HxQ2k...

Key types

Each account has two key pairs. Test keys run against the sandbox and never deliver a real message; live keys send real OTPs and are billed.

sk_test_…test keyoptional: Sandbox mode. No real SMS is sent and the code 000000 is always accepted. Use this everywhere except production.
sk_live_…live keyoptional: Production mode. Sends real OTPs over live delivery routes and counts toward billing.

Making an authenticated request

bash

curl https://api.otprelay.io/v1/verifications \  -H "Authorization: Bearer sk_live_51HxQ2k..." \  -H "Content-Type: application/json" \  -d '{ "to": "+966512345678" }'

Keep live keys server-side

A leaked sk_live_… key lets anyone send OTPs on your account. Never embed it in a mobile app, single-page app, or public repo. Call OTPRelay from your backend, and rotate keys from the dashboard if one is exposed.

Authentication errors

A missing, malformed or revoked key returns 401 Unauthorized with an authentication_error body.

401 Unauthorized

{  "error": {    "type": "authentication_error",    "code": "authentication_failed",    "message": "No valid API key provided.",    "doc_url": "https://otprelay.io/docs/authentication"  }}

See Errors for the full list of error types and codes.

Coming soon

Dashboard key management, rotation and IP allowlists are on the way.