Authentication

Every request to https://api.otpbay.com/v1 needs a project API key in the Authorization header:

curl https://api.otpbay.com/v1/project \
  -H "Authorization: Bearer otp_live_..."

An API key belongs to one project. Everything you send with it is billed to that project’s balance, and you can only read messages that project sent.

Create an API key

In the dashboard, open the project.
Go to API Keys and click New API key.
Copy the key. It starts with otp_live_.

OTPBay stores only a hash of the key, so it can’t show the key again. If you lose a key, create a new one and delete the old one.

Keep API keys on your server. Never put them in a mobile app, browser code or a public repository — anyone with the key can send messages on your balance.

Check a key

Call Get project to confirm a key works and see the balance it spends from:

{
  "id": "6650c1f2a9b3e4d5f6a7b8c9",
  "name": "Acme production",
  "balance": 24.37
}

Restrict keys to your IP addresses

Turn on the IP allowlist to accept API requests only from your servers. Open Settings in the dashboard, turn on Restrict API keys to these addresses and add up to 50 IPv4 or IPv6 addresses. With the allowlist on, a request from any other address fails with 403 IP_NOT_ALLOWED, even with a valid key. The allowlist applies to every API key in the project.

Authentication errors

Status	Code	Meaning
`401`	`MISSING_API_KEY`	The `Authorization: Bearer` header is missing.
`401`	`INVALID_API_KEY`	The key doesn’t exist or was deleted.
`403`	`IP_NOT_ALLOWED`	The IP allowlist is on and your address isn’t in it.

Get started

Channels

Concepts

Authentication

Create an API key

Check a key

Restrict keys to your IP addresses

Authentication errors

​Create an API key

​Check a key

​Restrict keys to your IP addresses

​Authentication errors

Create an API key

Check a key

Restrict keys to your IP addresses

Authentication errors