POST /otp/verify

POST /otp/verify

Checks a code against a challenge. Never returns the code, and never distinguishes “wrong” from “expired” in its status — the answer is verified: false.

Scope	otp
Auth	Authorization: Bearer mk_live_…
Content-Type	application/json (required)
Body limit	8192 bytes
Idempotency	Not used

Request

Field	Type	Required	Validation
challengeId	string	yes	Non-blank; must belong to the key’s account
code	string	yes	Non-blank; matched against /^\d{6}$/ — a malformed code is simply a non-match

curl -X POST https://app.maukirim.com/api/v1/otp/verify \
  -H "Authorization: Bearer mk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"challengeId": "otp_…", "code": "481902"}'

Response

200

{ "ok": true, "verified": true }

verified is false — still with HTTP 200 — when any of these is true:

• the code is wrong,
• the challenge was already verified,
• 5 attempts have been used,
• the challenge is older than 5 minutes,
• or the OTP message was never accepted by the gateway.

A wrong guess increments the attempt counter. After 5, the challenge can no longer verify even with the correct code.

Errors

HTTP	Code	Condition
400	invalid_input	challengeId or code missing/blank; wrong Content-Type; body over 8192 bytes or not an object
401	api_key_invalid / api_key_revoked / api_key_expired	See Authentication
403	api_key_scope_denied	The key lacks otp
404	not_found	No challenge with that id belongs to this account
500	server_error	Unexpected

Notes

• There is no rate limit on this route; the challenge’s 5-attempt budget is the bound.
• Because verification consumes the challenge, record “this account is verified” in your own storage rather than calling verify again later.