OTP — One-Time Passcode
What is OTP?
An OTP (one-time passcode) is a short numeric or alphanumeric code sent once — over SMS, voice, WhatsApp, email, or generated by an authenticator app — to prove a user controls a phone number, device, or account before letting them log in, reset a password, or complete a sensitive action. Because it expires and cannot be reused, an OTP is one of the most common second factors in two-factor authentication and phone-number verification flows.
More detail
An OTP is typically time-boxed (often 5-10 minutes) and single-use: once verified or expired, that exact code cannot be replayed. Delivery channel matters for reach — SMS OTP works on any phone, while an authenticator-app TOTP code works without network connectivity.
Rate-limiting OTP sends per recipient is a standard anti-abuse control, since an unthrottled OTP endpoint can be used to spam a phone number or run up SMS costs.
Frequently asked
- What is the difference between an OTP and a TOTP?
- An OTP is any one-time passcode, however it is delivered. A TOTP (time-based one-time password) is a specific kind of OTP generated locally by an authenticator app from a shared secret and the current time, rather than sent over a network channel.
- Which channels can deliver an OTP?
- Common channels are SMS, voice (a spoken code), WhatsApp, email, and RCS, alongside app-generated TOTP codes and push-based approval that doesn't require typing a code at all.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.