Korean OTP API

Phone verification for Korea, live in minutes.

Send codes over SMS or KakaoTalk AlimTalk and verify them with a second call. Retries never send twice.

Start in the consoleRead the docs
K-OTPAlimTalknow

[K-OTP] 인증번호는 482913입니다. 3분 내에 입력해주세요.

Verification code

  1. queued
  2. sent
  3. delivered
  4. verified

Two calls

Issue, then verify. That's the integration.

Every issue carries an idempotency key. If a request times out, retry with the same key — you get the original response, not a second message.

# 1. Issue a code — reuse the same key if you retrycurl https://api.k-otp.dev/v1/issue \  -H "Authorization: Bearer $KOTP_SECRET_KEY" \  -H "Idempotency-Key: signup-3f2a9c1e-0001" \  -H "Content-Type: application/json" \  -d '{    "phoneNumber": "01012345678",    "purpose": "signup",    "channel": "alimtalk",    "templateId": "otp_signup_kr"  }'# Response → { "issueId": "5b1f3c2e-…", "attemptsRemaining": 5, "expiresAt": "…" }# 2. Verify what the user typedcurl https://api.k-otp.dev/v1/verify \  -H "Authorization: Bearer $KOTP_SECRET_KEY" \  -H "Content-Type: application/json" \  -d '{ "issueId": "5b1f3c2e-8d4a-4f7e-9a61-2c0d7e9b4a10", "code": "482913" }'# Response → { "issueId": "5b1f3c2e-…", "verified": true, "verifiedAt": "…" }

Product

Built for the parts of OTP that go wrong

Delivery in Korea has its own channels, carriers, and retry traps. K-OTP handles them behind two endpoints.

  • SMS and AlimTalk, one API

    Pick the channel per request with a whitelisted template. If AlimTalk delivery fails, the code is sent by SMS automatically — still 1 credit.

  • Idempotency and safe retries

    Same key and payload returns the first result. Ambiguous provider outcomes are never auto-resent.

  • Delivery status you can show

    GET /v1/status combines verification and delivery into one overallStatus for your support team.

  • pk_ and sk_ keys

    Public keys call issue/verify from the browser, only from Origins you allow. Secret keys stay on your server.

  • Prepaid credits

    Top up once and pay 1 credit per OTP send on any channel. Check the balance and ledger over the API. No surprise invoices.

  • OpenAPI-first docs

    An OpenAPI 3.1 spec and a hosted reference, generated from the same contract the server enforces.

How it works

From signup to first verified code

  1. 01

    Create a key

    Sign up in the console and issue an sk_ key for your server or a pk_ key for your web app.

  2. 02

    Issue with a key

    POST /v1/issue with the phone number, purpose, and an idempotency key. A 6-digit code is generated server-side.

  3. 03

    We deliver and track

    The message is queued and sent over SMS or AlimTalk, with automatic SMS failover if AlimTalk fails. Status moves from queued to sent to delivered.

  4. 04

    Verify once

    POST /v1/verify with the issueId and code. Codes expire after 3 minutes and allow 5 attempts by default.

Security and privacy

We keep as little as possible, for as short as possible.

OTP is identity infrastructure. The defaults assume a breach will be attempted.

  • No raw phone numbers in issue records

    Issue records keep only a hash of the phone number. No API response returns it.

  • Codes are hashed and one-time

    Codes are stored as salted hashes, never returned by the API, and consumed on success.

  • Delivery PII is encrypted, then scrubbed

    Delivery records encrypt recipient fields and are scrubbed about 24 hours after a final status.

  • Browser keys are locked to your Origins

    pk_ keys require an exact Origin match and can only issue and verify.

Send your first code today.

Create a key in the console and follow the quickstart.

Create an accountSee pricing