otp.rip field guide
Automating verification through the otp.rip API
The otp.rip REST API exposes the same account catalogue and order rules used by the consoles. One account token can access the supported SMS and Email endpoints for that customer account. The API is bearer-authenticated and has no browser session.
Open the API referenceBuild the integration server-side
Create and rotate tokens from the protected API screen. A token is shown once and only its hash is stored, so copy it into a secret manager immediately. Send it in the Authorization header from your backend; never embed it in public JavaScript, a mobile bundle or a URL.
Start by listing services and countries or email types, then create an order only from an identifier returned by the API. Poll the order resource at a measured interval until a code is available or the order reaches a final state.
Respect limits and price controls
Read the rate-limit response headers and back off when requests are limited. Cache catalogue responses for a short practical interval rather than fetching the same list for every user action.
Use the API’s maximum-price protection when creating an order. Prices and availability can change between listing and purchase, so integrations should handle a changed or unavailable route without silently selecting a different product.
Keep customer boundaries intact
Tokens belong to one customer account. Order lookups are scoped to that account, and public API responses omit provider identifiers and wholesale cost fields. Store only the order data your application needs and protect received codes as sensitive information.
Use the published endpoint and error documentation rather than scraping the web console. The account API page contains current request and response examples.
Common questions
Can a token access another customer’s orders?
No. Tokens and order lookups are scoped to the owning customer account.
Should I call the API from browser JavaScript?
No. Keep bearer tokens and order operations on a trusted server.
Are prices fixed in the documentation?
No. Read current catalogue data and use maximum-price protection when ordering.