Authyo OTP API Reference

REST API for sending and verifying one-time passcodes (OTP) over SMS, WhatsApp, Voice, and Email. This is the API used by the Authyo integration for Make.com and by any server-to-server OTP flow.

Base URL: https://app.authyo.io/api/v1

Format: JSON responses; requests via query string (GET) or JSON body (POST)

Auth: two request headers — clientId and clientSecret

1. Authentication

Every request must include your application credentials as HTTP headers:

Header	Description
`clientId`	Your application's App Key
`clientSecret`	Your application's App Secret

You can find both in your Authyo dashboard under the application's settings.

Server-to-server note: If your application has an Authorized Endpoint (URL or IP allow-list) configured, calls without a matching Origin/Referer or source IP are rejected with Invalid endpoint. For server-to-server callers (such as Make.com, backend jobs, or automation platforms), leave Authorized Endpoint blank or add the caller's egress IPs.

2. Important response conventions

All endpoints return HTTP 200 OK, even on failure. Success or failure is indicated by the success boolean in the response body — not the HTTP status code.

{ "success": false, "message": "invalid clientId or clientSecret" }

Always branch on body.success. Treat success: false as an error in your integration.

3. Endpoints

3.1 Validate credentials

Checks that an App Key / App Secret pair is valid and the application is active. Does not send an OTP — ideal for testing a connection.

GET /api/v1/auth/authentication

Headers: clientId, clientSecret

Example

Success

{ "success": true, "message": "authenticated successfully" }

Failure

{ "success": false, "message": "authenticated not successfully" }

3.2 Send OTP

Generates and delivers a one-time passcode to a phone number or email address, and returns a maskId that identifies the OTP session. You use the maskId later to verify the code.

GET  /api/v1/auth/sendotp
POST /api/v1/auth/sendotp

Headers: clientId, clientSecret

Parameters

Name	Type	Required	Description
`to`	string	yes	Recipient — phone number (with country code, e.g. `+919876543210`) or email address
`authWay`	string	no	Delivery channel: `SMS`, `WHATSAPP`, `VOICE`, or `EMAIL`. If omitted, the application's default channel/priority is used
`otpLength`	integer	no	Number of digits in the generated OTP
`expiry`	integer	no	Validity window in minutes
`otp`	string	no	Supply your own OTP value instead of having Authyo generate one

Example (GET)

Example (POST)

Success

{
  "success": true,
  "message": "submited successfully",
  "data": {
    "isTried": 1,
    "isSent": 1,
    "results": [
      {
        "success": true,
        "message": "message submitted successfully",
        "to": "user@example.com",
        "authType": "Email",
        "maskId": "095b76f38de14c44a5b9f404fd276d6a",
        "createdTime": 1784050966,
        "expireTime": 1784051567,
        "charge": "0.00170068",
        "currency": "usd"
      }
    ]
  }
}

Key response fields

Field	Description
`data.results[].maskId`	Identifier for this OTP session — store this; required to verify
`data.results[].authType`	Channel the OTP was sent through
`data.results[].expireTime`	Unix timestamp when the code expires
`data.results[].charge` / `currency`	Cost of this send

Failure examples

{ "success": false, "message": "missing sender address" }
{ "success": false, "message": "invalid clientId or clientSecret" }
{ "success": false, "message": "Your account is currently blocked" }

3.3 Verify OTP

Validates the code entered by the user against the maskId returned by Send OTP. On success, returns a signed session JWT.

GET  /api/v1/auth/verifyotp
POST /api/v1/auth/verifyotp

Headers: clientId, clientSecret

Parameters (GET query / POST JSON body)

Name	Type	Required	Description
`maskId`	string	yes	The session id returned by Send OTP
`otp`	string	yes	The code the user entered

Example (GET)

Example (POST)

Success

{
  "success": true,
  "message": "verified",
  "status": "verified",
  "data": {
    "tokenType": "Bearer",
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "expiresIn": 1800,
    "user": {
      "email": "user@example.com",
      "userId": "AY-XXXXXX",
      "userApplicationId": 1234
    }
  }
}

Note: the JWT is at data.token (not token at the top level).

Failure examples

{ "success": false, "message": "missing parameters" }
{ "success": false, "message": "Invalid OTP" }
{ "success": false, "message": "OTP has expired" }

4. Error handling

Message	Meaning
`missing clientId or clientSecret in headers`	Auth headers not supplied
`invalid clientId or clientSecret`	Credentials wrong or app not found
`Invalid endpoint`	Caller blocked by the app's Authorized Endpoint allow-list
`application is inactive` / `user is inactive`	App or account disabled
`missing sender address`	`to` was empty on Send OTP
`missing parameters`	`maskId` or `otp` missing on Verify OTP
`Invalid OTP`	Code did not match

Some throttling responses also include a retryAfterSeconds field indicating how long to wait before retrying.

5. Rate limits & abuse protection

To protect against abuse, the API enforces:

A short per-recipient cooldown between sends to the same address.

A per-application burst limit on sends.

A brute-force lockout on verify: repeated wrong codes against the same maskId temporarily lock that session.

When a limit is hit, the response is success: false with a descriptive message and, where applicable, retryAfterSeconds.

6. Typical flow

Send — call sendotp with the recipient. Persist the returned maskId against that recipient (e.g. keyed by phone/email).

Collect — the user receives the code and enters it in your app/form.

Verify — call verifyotp with the stored maskId and the entered code.

On success: true, the user is verified; use the returned session token if you need one.

Support: support@authyo.io · https://app.authyo.io

Authyo - Make

Authyo OTP API Reference#

1. Authentication#

2. Important response conventions#

3. Endpoints#

3.1 Validate credentials#

3.2 Send OTP#

3.3 Verify OTP#

4. Error handling#

5. Rate limits & abuse protection#

6. Typical flow#

Authyo OTP API Reference

1. Authentication

2. Important response conventions

3. Endpoints

3.1 Validate credentials

3.2 Send OTP

3.3 Verify OTP

4. Error handling

5. Rate limits & abuse protection

6. Typical flow