Answer
OTP (One-Time Password) is a one-time password/code that lives for a short time (TTL) and confirms possession of a phone number.
Typical flow:
- The user enters their number in your product.
- The backend requests code delivery (
POST /otp/send). - The person reads the message in WhatsApp / Telegram / SMS.
- Enters the code in the form.
- The backend verifies the code (
POST /otp/verify) and continues the scenario (registration, login, payment, terms).
OTP reduces the risk of simple attacks with a stolen password, but it does not replace rate limits, API-key protection, antifraud, and clear resend UX.
Synonyms in UIs and articles: One-Time Password, verification code, authentication. Do not confuse with SMS-activation / virtual number rental.
How this relates to Cascade
Cascade is outbound delivery of OTP and short links to your user’s real phone. Base URL: https://cascade.kz/api, authorization Authorization: Bearer <token>. Price orientation — from 3 ₸; WhatsApp/Telegram = 3 ₸, SMS = 8 ₸. Full guide: /docs, reference: /api.
Practical steps
- Register a company and get an API key.
- Call
POST /otp/send. - The user enters the code in your form.
- Confirm via
POST /otp/verify. - Errors: /api/errors, limits: /api/rate-limits.
Limits
Delivery depends on the network and channel. Do not store the key on the client. Products usually start with WhatsApp/Telegram and leave SMS as a more expensive fallback. Service comparisons: /compare, Kazakhstan overview: /compare/best-otp-kazakhstan.