OTP in simple terms
OTP stands for One-Time Password. It is usually a short numeric code that a user receives on their phone and enters in a website or application.
Unlike a permanent password, an OTP:
- has a short expiration time;
- belongs to one verification purpose;
- becomes invalid after successful use;
- should never be treated as a reusable credential.
Teams use OTP for signup, passwordless login, account recovery, phone verification, and confirmation of sensitive actions.
How phone verification works
A typical flow involves the user, your backend, and the delivery service:
- The user enters a phone number in your interface.
- Your backend calls
POST /api/otp/sendin Cascade. - Cascade creates and delivers the code through an available channel.
- The user enters the received code in your product.
- Your backend sends it to
POST /api/otp/verify. - After successful verification, your product completes the requested action.
Keep the API key out of browser and mobile code. Both API calls must originate from your backend and use Authorization: Bearer <token>.
Available delivery channels
WhatsApp and Telegram are currently available publicly. Successful delivery through either channel costs 3 credits. SMS exists in the architecture and billing model, but the public SMS provider is not live yet.
Channel selection depends on company settings and recipient availability. The user experience stays simple: the person receives a six-digit code and enters it in your product.
See current commercial terms on the pricing page and technical details in the documentation.
Expiration and resend behavior
A standard Cascade OTP has 6 digits and expires after 300 seconds, or 5 minutes. A short lifetime reduces the window in which a copied or intercepted code can be abused.
Longer expiration is not automatically more convenient. A clear countdown and a controlled resend flow are usually safer than keeping the same code active for too long.
Security checklist
OTP is only one part of a secure authentication flow. Your product should also implement:
- limits per phone number, account, and IP address;
- a cap on verification attempts;
- a cooldown before resending;
- server-side secret storage for the API key;
- redaction of codes and tokens from logs;
- neutral responses that do not reveal whether an account exists;
- monitoring for errors, repeated sends, and abnormal activity.
For high-risk operations, combine OTP with session checks, anti-fraud controls, or an additional factor.
OTP is not virtual-number rental
Cascade does not provide temporary phone numbers. You submit your own user's number and Cascade sends a code to that number.
Virtual-number services provide a third-party number that receives messages from another platform. That is a different product and use case. If you need to verify customers of your own website or app, you need an outbound OTP API.
Start the integration
Create an account, obtain a server-side API key, and follow POST /otp/send. Then implement POST /otp/verify, handle documented API errors, and add webhooks when your product needs asynchronous delivery events.
New accounts receive 1000 starting credits, which can be used to test the integration and user experience before production rollout.