OTP SMS API for India: Send & Verify OTP in Minutes (with Code)

An OTP SMS API does one job: your website or app calls one endpoint to send a one-time password to a customer’s mobile, and another endpoint to check what the customer typed. If both calls work reliably, you can verify any Indian mobile number in seconds, and everything built on that: signup verification, passwordless login, cash-on-delivery confirmation, becomes possible. This guide explains why stores in India need OTP verification more than most, and then shows the complete Fast2SMS OTP SMS API integration with working cURL and PHP code.

Signup Now

Why Indian stores need OTP verification

India’s ecommerce runs on cash on delivery more than almost any market, and that changes what “verification” means for a store:

Fake COD orders. A wrong or made-up mobile number costs you shipping both ways, packaging, and a blocked unit of stock. One OTP at checkout confirms a real, reachable customer before the parcel leaves.
Account takeovers and password pain. Customers reuse weak passwords, then forget them. OTP login removes the password entirely: the phone becomes the key, and support stops answering reset emails all day.
Coupon and signup abuse. “First order 50% off” invites one customer with ten fake accounts. Verified mobile numbers make each identity cost a real SIM, which kills the economics of abuse.
Dead contact data. Delivery riders call before arriving; marketing sends order updates. Both fail if the number was typed wrong. Verification at entry keeps the whole downstream chain working.
Customer trust. An OTP at signup or checkout signals a store that takes security seriously, the same pattern customers know from their bank and UPI apps.

Verification funnel showing where fake orders and dead numbers drop off when OTP verification is added — Every unverified number that enters your funnel costs money further down. OTP moves the filter to the top.

What a good OTP SMS API handles for you

Sending a text is the easy part. A production OTP system also needs code generation, expiry, retry limits, resend windows, storage that never leaks, DLT-compliant templates, and a fallback when SMS does not arrive. The Fast2SMS OTP API does all of that server-side:

You never generate or store OTPs. The API creates the code, sends it, and checks it on verify. Your database never holds an OTP, so there is nothing to leak.
Smart OTP fallback. An OTP ID can send on WhatsApp first and automatically fall back to DLT SMS if WhatsApp delivery fails, or the reverse. One API call, two delivery paths.
Resend built in. Customers can request the code again within a 10 minute window, without your code juggling timers.
DLT handled. Ready OTP templates and free DLT support cover the compliance side of SMS in India.

Smart OTP flow diagram: one API call sends OTP on WhatsApp with automatic SMS fallback — Smart OTP: one send call, WhatsApp first, SMS fallback automatic. Your code never knows the difference.

Step 1: Create your OTP ID

Signup free at fast2sms.com, open the Smart OTP section and create an OTP ID. That is where you pick the channel (SMS, WhatsApp, or WhatsApp with SMS fallback), the template, and the sender. The OTP ID is the only thing your code needs besides the API key from the Dev API section.

Smart OTP tab in the Fast2SMS panel with WhatsApp OTP primary and SMS fallback configured — One OTP ID holds channel, template and fallback settings, so code stays one line simple.

Step 2: Send the OTP

curl --request POST \
     --url https://www.fast2sms.com/dev/otp/send \
     --header 'Authorization: YOUR_API_KEY' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '{
       "otp_id": "11111111",
       "mobile": "8888888888"
     }'

Success response:

{
  "return": true,
  "status_code": 200,
  "request_id": "lwdtp7cjyqxvfe9",
  "message": "OTP sent successfully"
}

Step 3: Verify what the customer typed

curl --request POST \
     --url https://www.fast2sms.com/dev/otp/verify \
     --header 'Authorization: YOUR_API_KEY' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '{
       "mobile": "8888888888",
       "otp": "123456"
     }'

{
  "return": true,
  "status_code": 200,
  "message": "OTP verified successfully"
}

Wrong or expired code returns "return": false, so one if-check gates your signup, login or COD confirmation. Full reference: send OTP and verify OTP at docs.fast2sms.com.

The whole flow in PHP

<?php
// 1. Send the OTP when the customer submits their mobile
$ch = curl_init('https://www.fast2sms.com/dev/otp/send');
curl_setopt_array($ch, array(
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => array(
        'Authorization: YOUR_API_KEY',
        'Content-Type: application/json',
        'Accept: application/json',
    ),
    CURLOPT_POSTFIELDS     => json_encode(array(
        'otp_id' => '11111111',
        'mobile' => $customerMobile,
    )),
));
$send = json_decode(curl_exec($ch), true);
curl_close($ch);

if (empty($send['return'])) {
    exit('Could not send OTP, try again.');
}

// 2. Later, verify the code the customer typed
$ch = curl_init('https://www.fast2sms.com/dev/otp/verify');
curl_setopt_array($ch, array(
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => array(
        'Authorization: YOUR_API_KEY',
        'Content-Type: application/json',
        'Accept: application/json',
    ),
    CURLOPT_POSTFIELDS     => json_encode(array(
        'mobile' => $customerMobile,
        'otp'    => $enteredOtp,
    )),
));
$verify = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($verify['return'])) {
    // Verified: create the account, log the user in, or confirm the COD order
} else {
    // Wrong or expired OTP: show an error, offer resend
}

Notice what is missing: no OTP generation, no expiry cron, no code comparison, no OTP column in your database. The API owns all of it. Need delivery events in your own system (mark verified numbers, alert on failures)? OTP webhooks push delivered and failed statuses to your endpoint: how webhooks work.

No code? The same API powers ready plugins

WordPress: free plugin with OTP login and signup verification; install from WordPress.org.
WooCommerce: OTP verification for checkout and registration, including COD confirmation.
Shopify: the official app covers storefront OTP login: integrate OTP with Shopify.
Everything else: the two endpoints above work from any language or stack that can make an HTTPS POST.

OTP SMS API vs building it yourself

	Build in-house	Fast2SMS OTP API
OTP generation, expiry, storage	Your code, your database, your risk	Server-side, never touches your DB
DLT registration and templates	You research and file	Ready templates + free DLT support
When SMS does not arrive	Customer stuck, order lost	Smart OTP auto-falls back to WhatsApp or SMS
Resend handling	More timers in your code	Built in, 10 minute window
Cost structure	Developer time + gateway contracts	No setup or monthly fee, pay per message

What it costs

There is no setup fee, no monthly platform fee and no minimum commitment: you pay the per-message rate from your wallet, and only for what you send. WhatsApp OTPs bill on delivery basis with failed messages auto-refunded, at ₹0.25 per authentication message (₹0.11 on high-volume plans). SMS OTPs go at your account’s DLT SMS rate. A slow month costs you nothing.

Frequently asked questions

What is an OTP SMS API?

Two REST endpoints: one sends a one-time password to a mobile number, the other verifies the code the user entered. Your application calls them over HTTPS with an API key; the provider handles generation, delivery, expiry and checking.

How fast do OTPs arrive?

OTP routes are prioritised for speed and typically arrive within seconds, with Smart OTP falling back to the second channel automatically when the first fails, so the customer is never left waiting on a dead channel.

Do I need DLT registration to send OTP SMS?

SMS OTPs in India need DLT like all business SMS; Fast2SMS provides ready OTP templates and free DLT support. WhatsApp OTPs need no DLT at all, which is why many stores start with WhatsApp-first Smart OTP.

Do I have to store OTPs in my database?

No, and you should not. The verify endpoint checks the code server-side; your system only ever sees verified or not verified.

Can the customer ask for the OTP again?

Yes, resend works within a 10 minute window per send, without extra logic on your side.

Which platforms can use this without code?

WordPress, WooCommerce and Shopify all have free official Fast2SMS plugins running on the same OTP API, covering login, registration and checkout verification.

What does an OTP cost?

No monthly or setup fee; per-message billing only. WhatsApp authentication messages are ₹0.25 (₹0.11 high volume) on delivery basis with auto refund for failures; SMS follows your DLT SMS rate.

Where is the full API documentation?

At docs.fast2sms.com, including send, verify and resend references. The wider product is covered in the Smart OTP guide and the bulk SMS API guide.

Verify your first number today

Create your free account, make one OTP ID, and the two API calls above turn any signup form, login page or COD checkout into a verified one this afternoon.