POST/v1/otp/verify

Verify a one-time password

Checks the code your user typed against the one this gateway sent. Single use: the first correct submission wins and every later one is refused.

AuthenticationDevice token

Request

shell

curl -X POST https://api.sapa.tokoaplikasi.id/v1/otp/verify \
  -H "Authorization: Bearer $WA_TOKEN"

Body

Field	Type	Description
otpIdrequired	string	The `otpId` returned by `POST /v1/otp/send`.
coderequired	string	The 6 digits your user typed, as a string — a leading zero is significant and a number would lose it.

Response

200 — The code matched. This is the only successful outcome.

json

{
  "status": true,
  "otpId": "",
  "verified": true
}

Field	Type	Description
status	true	Always true on a successful request.
otpId	string	The one-time password that was verified.
verified	true	Always true. A code that does not match is an error response, not `verified: false` — match on `reason` (`code invalid`, `otp expired`, `otp exhausted`) to tell them apart.

Failure modes

Every failure answers with the same envelope: { "status": false, "reason": "…" }. Match on reason, never on the status alone — the full vocabulary is on the Errors page.

Field	Type	Description
400	error	The code did not match (`code invalid`), the one-time password is past its expiry or already used (`otp expired`), or it ran out of attempts (`otp exhausted`).
401	error	The token is missing, malformed or revoked.
403	error	An account token was used; verifying needs the device token.
404	error	No one-time password with that id belongs to this device. The same answer covers an id that never existed and one that belongs to somebody else.
429	error	Too many requests for this token. Wait the seconds in `retryAfter`.