Skip to main content
POST
Verify an OTP code

Authorizations

Authorization
string
header
required

Your Robase API key. Starts with robe_. Include as Authorization: Bearer robe_...

Headers

Idempotency-Key
string

Opaque client-generated key. Replaying the same key within 24 hours returns the original response instead of performing the action again. Recommended for every send so a network-level retry cannot double-charge.

Maximum string length: 255

Body

application/json
otp_id
string<uuid>
required

The id returned by the send endpoint

code
string
required

The code the user entered

Example:

"123456"

Response

The code was checked. valid reports whether it matched; a false result still counts against the attempt budget.

valid
boolean
required

Whether the submitted code matched

status
enum<string>
required

The OTP's state after this attempt. verified on success; failed once the attempt budget is exhausted.

Available options:
pending,
sent,
verified,
failed
attempts_used
integer
required

Verification attempts made so far, including this one

attempts_remaining
integer

Attempts left before the OTP is burned. Present only when valid is false.