What is sendotp.email?

sendotp.email is an API for email one-time passwords and access codes. It sends an OTP to an email address and verifies it for login, lists, private content, generated reports, and other email-gated flows, keeping the code stable for 10 minutes and rejecting disposable email addresses.

How long is an OTP stable?

The same email address receives the same OTP for 10 minutes. Repeated calls during that window are idempotent and do not create a rolling bucket of new codes.

Does it block disposable email addresses?

Yes. Known disposable and throwaway email domains are rejected before an OTP is sent, so verifications for lists, reports, private content, and signups land on real, reachable inboxes.

Can I use email OTPs for generated reports or private content?

Yes. You can verify the visitor's email before showing a generated report, file download, private album, or client portal, then let the same address request a stable code again when they come back.

OTP

Verify OTP

Verify a submitted email code against the live idempotent OTP record.

Copy page

POST/v1/verify

Verify code

cURL

curl --request POST \
  --url https://api.sendotp.email/v1/verify \
  --header "Authorization: Bearer $SENDOTP_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"email":"[email protected]","purpose":"report-access","code":"493021"}'

200

The submitted code matched.

{
  "valid": true
}

Overview

Checks the code for the normalized email and purpose, rejects expired records, and tracks failed attempts until the configured limit is reached.

Authorization

Bearer API keyAuthorizationrequired

Use the same server API key model as send. Verification should happen from your backend.

Request

emailstringrequired

Email address originally used to request the code.

purposestringrequired

The exact purpose used when the code was sent.

codestringrequired

Code entered by the user from their email.

Responses

200

The submitted code matched.

{
  "valid": true
}

200

The code was expired, wrong, or over the attempt limit.

{
  "valid": false,
  "reason": "expired"
}