Hashed at rest
Plaintext OTP codes are never stored. Verification compares against a hash so a database leak does not expose active codes.
OTP
OTP SMS Ghana — verification codes you can inspect
Login codes, payment PINs, and account verification for Ghana numbers. POST /v1/verify/send dispatches the SMS; POST /v1/verify/check validates the code your user typed — with hashed storage, cooldown, and a delivery report you can open later.
API
Verify send
POST /v1/verify/send
curl -X POST "https://api.taysend.com/v1/verify/send" \
-H "Authorization: Bearer sms_test_..." \
-H "Content-Type: application/json" \
-d '{ "to": "+233200000001", "locale": "en" }'Security
Security by design
Cooldown and limits
Per-phone send cooldown, max verification attempts, and send-rate limits are enforced server-side — not left to client logic.
TEST never hits handset
sms_test_ keys use simulated numbers. You can exercise the full send-and-check flow without delivering to a real phone.
Dedicated queue
OTP traffic routes separately from bulk campaigns so a large marketing blast does not delay login codes.
Explicit check outcomes
POST /v1/verify/check returns verified, expired, invalid, or max attempts — not a generic success when the code is wrong.
Inspectable path
The same message id and DLR model applies. Open GET /v1/messages/:id to see whether the OTP SMS was delivered, failed, or expired.
Compare
OTP vs bulk SMS
OTP is for one-to-one verification with short-lived codes. Bulk SMS is for campaigns to many recipients via lists or the recipients array. They use different queues so neither starves the other. For marketing blasts, see bulk SMS.
Explore
Related
Each page answers a different question. They are not copies of this one.
FAQ
Straight answers
If something here is product behaviour, it matches the dashboard and the API.
01What endpoints do I use for OTP?+
POST /v1/verify/send to dispatch a code, POST /v1/verify/check to validate it. Both require Bearer authentication.
02Can I use OTP in TEST mode?+
Yes. TEST keys send to simulated numbers only. The verify/check flow works the same way without touching a real handset.
03Do I need a sender ID for OTP?+
LIVE OTP requires an approved alphanumeric sender ID (3–11 characters). TEST uses the sandbox sender TAYSEND.
04Should I log OTP codes in my app?+
No. Never log plaintext codes. Use the check endpoint and handle expired or max-attempt responses in your UI.