Ready-to-Use OTP API: send OTPs without building them

One request per OTP

Each channel has its own endpoint, and all three work the same way: a GET request from your server with the recipient’s number. Your API key is part of the URL, so always call the API from your backend, never from browser or app code.

Channel endpoints: whatsappeazyotp, globalsmseazyotp and smseazyotp.

Read the EazyOTP API documentation →

Request (curl, from your server)

curl --location 'https://app.pingtochat.com/api/v1.0/{YOUR_API_KEY}/whatsappeazyotp?number=91XXXXXXXXXX' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer {YOUR_TOKEN}'

Success response (from the documentation)

{
  "status": "success",
  "message": "WhatsApp OTP Sent Successfully",
  "track_id": "WA76B9FBQR3",
  "recipients": [
    {
      "mobile_number": "91xxxxxxxxxx",
      "status": "sent",
      "error_code": null,
      "error_description": null,
      "time": "2026-01-08 14:15:22"
    }
  ],
  "otp": "748219"
}

Error response (from the documentation)

{
  "status": "error",
  "message": "Invalid WhatsApp number or service not activated"
}

Verify the OTP on your server

The API returns the code it sent, so verification happens in your backend. Follow these rules:

• Store only a hash of the OTP, never the plain code
• Expire it after a few minutes and allow it to be used once
• Limit attempts and resends for each number
• Never return the OTP to the browser or app (more in our guide to verifying OTPs securely)

This is example code for your own server. The EazyOTP parts are the documented request and response fields.

PHP (your backend)

<?php
// 1. Send: call EazyOTP from your server (never from the browser)
$url = "https://app.pingtochat.com/api/v1.0/{$apiKey}/whatsappeazyotp?number=" . urlencode($number);
$ch  = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json', "Authorization: Bearer {$token}"],
]);
$res = json_decode(curl_exec($ch), true);

if (($res['status'] ?? '') === 'success') {
    // 2. Store only a hash of the code, with a short expiry
    $_SESSION['otp'] = [
        'hash'     => password_hash($res['otp'], PASSWORD_DEFAULT),
        'expires'  => time() + 300,
        'attempts' => 0,
        'track_id' => $res['track_id'],
    ];
}

// 3. Verify: compare what the user typed, on the server
function verify_otp(string $typed): bool {
    $o = $_SESSION['otp'] ?? null;
    if (!$o || time() > $o['expires'] || ++$_SESSION['otp']['attempts'] > 5) return false;
    if (!password_verify($typed, $o['hash'])) return false;
    unset($_SESSION['otp']); // one-time use
    return true;
}