OTP & verification
Two calls to verify anyone, and the code never touches your database.
One call sends a one-time code, a second checks it. Aslio never stores or returns the code itself — only a salted hash — and the whole thing bills from the same prepaid wallet at ₹0.02 a message — about $0.21 per 1,000 emails.
In short
Aslio's OTP API sends a one-time passcode with `POST /v1/otp/send` and checks it with `POST /v1/otp/verify`. The code is never stored or returned — only a salted hash — and expires in five minutes by default. Five wrong guesses lock the challenge, a resend invalidates earlier codes, and per-destination throttles blunt SMS-pumping attacks. Email works today; SMS and WhatsApp are in build.
- 2
- calls, end to end
- 5 min
- default code lifetime
- 5
- wrong guesses then locked
- 0
- codes stored in plaintext
Code
Send, then verify
You never handle the code, generate it, store it, or write the expiry logic — which is exactly where hand-rolled OTP tends to go wrong.
POST /v1/otp/send
{ "channel": "email",
"to": "priya@example.com",
"from": "no-reply@acme.com" }
→ { "id": "otp_…", "status": "PENDING", "expiresAt": "…" }
POST /v1/otp/verify
{ "id": "otp_…", "code": "482913" }
// The code itself is never stored or returned — only a salted
// hash. Expires in 5 minutes. Five wrong guesses lock the
// challenge. A resend invalidates every earlier code.What you get
What is handled for you
Every item here is a way hand-rolled OTP commonly fails in production.
Codes are never stored
Only a salted hash is kept. A database leak does not hand an attacker a list of live codes.
Expiry, by default
Five minutes unless you say otherwise. No cron job to write and no stale challenge to reason about.
Guess limiting
Five wrong attempts lock the challenge, so a code cannot be brute-forced in the sixty seconds it is alive.
Resend invalidation
Issuing a new code kills the earlier ones, which closes the window where two valid codes exist at once.
Pumping throttles
Per-destination rate limits blunt SMS-pumping fraud, where an attacker farms revenue by triggering floods of messages.
DLT handled (SMS, in build)
When SMS ships, the code is inserted into your registered DLT template automatically rather than being your problem.
Honestly
Before you build on this
- Email OTP is what ships today. SMS and WhatsApp OTP are in build. If you need SMS OTP this month, this is not yet your product.
- We hold no SOC 2 report and no ISO 27001 certification. If your procurement requires one, we will not pass it today and would rather say so now.
- We are a young, small company — Asli One Global was incorporated in February 2026. That is a legitimate thing to weigh for a critical dependency.
FAQ
Frequently asked questions
How does the Aslio OTP API work?
Two calls. POST /v1/otp/send with a channel, a destination and a from address returns an id and an expiresAt. POST /v1/otp/verify with that id and the code the user typed returns whether it matched. You never generate, store or expire the code yourself.
Is the one-time code stored anywhere?
Only as a salted hash. The plaintext code is never stored and never returned by the API, so a database compromise does not yield a list of usable codes.
How long is a code valid?
Five minutes by default. Five wrong guesses lock the challenge, and issuing a resend invalidates every earlier code so there is never more than one live code per challenge.
Can this be abused for SMS pumping?
It is throttled per destination specifically to blunt that. SMS-pumping fraud works by triggering floods of messages to numbers the attacker profits from, and an unthrottled OTP endpoint is the usual way in.
Does OTP over SMS work today?
Not yet — SMS is in build. Email OTP ships now. When SMS lands, the code is filled into your registered DLT template automatically for Indian destinations.
What does OTP cost?
The message it sends, and nothing else — email is ₹0.02, about $0.21 per 1,000, from the same prepaid wallet as everything else. There is no monthly platform fee, no per-seat charge and no minimum commitment, and no separate charge for the verification call.
Stop hand-rolling one-time codes.
Top up a wallet and send. No monthly platform fee, no seat charge, no minimum commitment — a hundred test emails costs about one rupee.
Asli One Global Private Limited · CIN U62011TN2026PTC190105