Authentication & API keys

Every public API request carries a workspace API key in the Authorization header:

Authorization: Bearer otp_live_xxxxxxxxxxxxxxxxxxxxxxxx

Creating keys

• Dashboard → API keys → Create key (role developer or higher).
• The full key is shown once. Otpera stores only an HMAC-SHA256 hash, so a lost key can't be recovered: create a new one and revoke the old one.
• Name keys after where they're used (e.g. production-backend, shopify-main-store).

Scopes

Scope	Allows
verifications:write	Create, check, resend and read OTP verifications
orders:write	Create orders and resend confirmations (Orders API), the Shopify webhook
orders:read	Read orders, items, status history and messages

Give each key only the scopes it needs.

Test your key

curl https://api.otpera.com/api/v1/ping -H "Authorization: Bearer $OTPERA_API_KEY"

{
  "ok": true,
  "workspace": { "id": "…", "name": "My store" },
  "scopes": ["verifications:write"],
  "time": "2026-11-05T10:00:00.000Z"
}

Keep keys secret

Server-side only

Never put an API key in browser JavaScript, a mobile app, a public repository or a VITE_* / NEXT_PUBLIC_* variable. Anyone with the key can send messages from your WhatsApp number and spend your credits.

A missing, invalid, expired or revoked key returns 401 unauthorized. A key without the required scope returns 403 forbidden.