{"info":{"_postman_id":"1da462fa-59d1-4117-9a43-eb51efa7dd1e","name":"Public API Compacto OTP","description":"

Endpoints

\n\n
\n

Welcome to the Compacto Public API documentation.
Here you will find all available public endpoints for generating and validating One-Time Passwords (OTPs).

\n

Each endpoint includes required headers, body format, examples, and possible error messages.

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[],"owner":"36638207","collectionId":"1da462fa-59d1-4117-9a43-eb51efa7dd1e","publishedId":"2sB3HnMLco","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2025-09-10T16:52:08.000Z"},"item":[{"name":"Public-generate-otp","id":"d320468e-36db-4ee9-b929-cb91fc7e5b0c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"x-api-key","value":"{{YOUR_API_KEY}}","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"channel\": \"email\",\r\n \"provider\": \"generic\",\r\n \"destination\": \"wajb96@gmail.com\",\r\n \"type\": \"alphanumeric\",\r\n \"length\": 8,\r\n \"expiresInSeconds\": 300,\r\n \"templateId\": \"otp-default-a1562ab2\"\r\n}\r\n","options":{"raw":{"language":"json"}}},"url":"https://cpt.cx/otp/generate","description":"

Description

\n

This endpoint generates a One-Time Password (OTP) and queues it for delivery via the selected channel.

\n

For security, the OTP value is never returned; only metadata and the otpId are provided.

\n

Authentication

\n

This endpoint requires an API Key in the request headers:

\n
x-api-key: YOUR_API_KEY\nContent-Type: application/json\n\n
\n
Request Body (JSON)
\n

Required fields:

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
channelstringDelivery channel. Allowed values: \"email\", \"sms\".
providerstringProvider name previously configured in Compacto** (e.g., \"generic\", \"twilio\", \"sendgrid\"). Credentials/settings are managed server-side; clients send only the name. If the provider does not exist or isn’t configured for the client/channel, the API returns 400 with `Provider not found for this client and channel.
destinationstringRecipient: an email address (for email) or an E.164 phone number (for sms).
typestringOTP type. Allowed values: \"numeric\", \"alphanumeric\".
lengthnumberOTP length (e.g., 6 or 8).
expiresInSecondsnumberOTP time-to-live in seconds (e.g., 300).
\n
Valid Request Example
\n
{\n  \"channel\": \"email\",\n  \"provider\": \"generic\",\n  \"destination\": \"test@ejemplo.com\",\n  \"type\": \"alphanumeric\",\n  \"length\": 8,\n  \"expiresInSeconds\": 300\n}\n\n
\n
Succesful Response
\n
{\n  \"otpId\": \"51a6fcc7-efc8-4e69-8bc1-ebb999befb2c\",\n  \"destination\": \"test@ejemplo.com\",\n  \"createdAt\": \"2025-09-10T14:05:41.5251815Z\",\n  \"expiresAt\": \"2025-09-10T14:10:41.5251815Z\"\n}\n\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
otpIdstringUnique identifier for the OTP. Use it later to validate the code.
destinationstringTarget email or phone number.
createdAtdatetimeUTC timestamp when the OTP was created.
expiresAtdatetimeUTC timestamp when the OTP expires.
\n
Invalid Cases and Error Messages
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CaseInvalid Example (JSON)Response
Missing channel{\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":8,\"expiresInSeconds\":300}OTP channel is required and must be either 'Email' or 'Sms'.
Missing destination{\"channel\":\"email\",\"provider\":\"generic\",\"type\":\"alphanumeric\",\"length\":8,\"expiresInSeconds\":300}Destination (email or phone number) is required.
Missing type{\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"length\":8,\"expiresInSeconds\":300}OTP type is required.
Missing length{\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"expiresInSeconds\":300}OTP length is required.
Missing expiresInSeconds{\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":8}ExpiresInSeconds is required.
Invalid email format{\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"testejemplo.com\",\"type\":\"alphanumeric\",\"length\":8,\"expiresInSeconds\":300}Invalid email format. It must be like name@example.com.
Invalid phone format (SMS){\"channel\":\"sms\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":8,\"expiresInSeconds\":300}Invalid phone number format. Must start with country code
Unknown/unconfigured provider{\"channel\":\"email\",\"provider\":\"emailsenderotp\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":8,\"expiresInSeconds\":300}Provider not found for this client and channel.
OTP length out of range (4–12){\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":2,\"expiresInSeconds\":300}OTP length must be between 4 and 12.
Non-positive expiration{\"channel\":\"email\",\"provider\":\"generic\",\"destination\":\"test@ejemplo.com\",\"type\":\"alphanumeric\",\"length\":4,\"expiresInSeconds\":0}ExpiresInSeconds must be greater than zero.
\n

Notes

\n\n

HEADERS
x-api-key — {{YOUR_API_KEY}}
Content-Type — application/json

\n

Body
raw (json) — see example above.

\n","urlObject":{"protocol":"https","path":["otp","generate"],"host":["cpt","cx"],"query":[],"variable":[]}},"response":[],"_postman_id":"d320468e-36db-4ee9-b929-cb91fc7e5b0c"},{"name":"Public-validate-otp","id":"e30eadc8-0d34-4cf5-8dd2-32ba80ac2597","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"x-api-key","value":"{{YOUR_API_KEY}}","type":"text"}],"body":{"mode":"raw","raw":"\r\n{\r\n \"otpId\": \"c4f8814c-7a9d-4e13-b7d8-d4e66d272611\",\r\n \"otp\": \"z4dGyBPQ\"\r\n}","options":{"raw":{"language":"json"}}},"url":"https://cpt.cx/otp/validate","description":"

Description

\n

Validates a previously generated OTP using the otpId and the user-entered otp.

\n

On success, the OTP is consumed (one-time use) and cannot be reused.

\n

Authentication

\n

This endpoint requires an API Key in the request headers:

\n
x-api-key: YOUR_API_KEY\nContent-Type: application/json\n\n
\n
Request Body (JSON)
\n

Required fields:

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
otpIdstringThe identifier returned by /otp/generate.
otpstringThe OTP code entered by the user.
\n
Valid Request Example
\n
{\n  \"otpId\": \"c4f8814c-7a9d-4e13-b7d8-d4e66d272611\",\n  \"otp\": \"z4dGyBPQ\"\n}\n\n
\n

Successful Response (200)

\n
{\n    \"success\": true,\n    \"message\": \"OTP validated successfully.\"\n}\n\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FieldTypeDescription
successbooleantrue when the OTP is valid and accepted.
messagestringHuman-readable confirmation message.
\n
Invalid Cases and Error Messages
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CaseInvalid Example (JSON)Response
Missing otpId{\"otp\":\"n2gR\"}OtpId is required.
Missing otp{\"otpId\":\"7dd25d97-1ae3-49a7-8aa7-54211a3fecac\"}Otp is required.
Incorrect or expired OTP{\"otpId\":\"7dd25d97-1ae3-49a7-8aa7-54211a3fecac\",\"otp\":\"n2gR\"}Invalid OTP or expired.
Too many failed attempts (temporary lock){\"otpId\":\"c0d1c4ad-b46c-4e27-8731-625d381e7182\",\"otp\":\"rIayv2gN\"}Too many failed attempts. Try again later.
\n

Behavior note:
If the allowed attempts (configured in Compacto for the provider) are exceeded, further validations will return
Too many failed attempts. Try again later. — even if the OTP is correct — until the lock duration elapses.

\n

Notes

\n\n","urlObject":{"protocol":"https","path":["otp","validate"],"host":["cpt","cx"],"query":[{"disabled":true,"key":"","value":null}],"variable":[]}},"response":[],"_postman_id":"e30eadc8-0d34-4cf5-8dd2-32ba80ac2597"}]}