Initiate a Reverse OTP session
What is a Reverse OTP?
A reverse OTP verifies a user’s phone number by having the user send a code to you via SMS or iMessage, rather than you sending it to them. This approach offers several key benefits compared to traditional OTPs:- Receiving SMS messages is easy and often free, so attackers may abuse online services to receive codes and bypass standard verification.
- Sending an SMS, however, requires the user to use their own phone and carrier plan, making it more difficult to fake and providing greater confidence in the user’s authenticity.
- You save on operational costs, since you’re not paying to send SMS codes to your users.
- Message delivery rates are often higher. Outbound SMS can be blocked, delayed, or filtered by carriers—especially for international users or high-volume senders. When users initiate the message themselves, it is much more likely to be delivered, as their carrier typically supports sending SMS to the US from anywhere in the world.
service to "sms" or "imessage". It defaults to "sms" when omitted. iMessage requires an active iMessage-capable leased number and an iMessage entitlement. Learn more about Reverse OTP with iMessage.Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Expected sender phone number. Must be in E.164 format.
"+15551234567"
Code or phrase the user will send. Defaults to a random 4-digit code if not provided.
16"1234"
Phone number to text. If you lease a number from Contiguity, you can enter it here. Defaults to a random Contiguity-owned number.
"+16465550123"
Messaging service to receive the code on. Defaults to SMS. iMessage requires an active iMessage-capable number on your account.
sms, imessage "sms"
Language code for UI strings
"en"
Webhook URL to post successful verification. By default, Contiguity will use your existing webhook preferences.
"https://example.com/webhooks/otp/success"
