> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dojah.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate OTP

> Confirm a one-time passcode against the reference_id returned by Send OTP with the Dojah Messaging API.

<div className="dj-endpoint">
  <span className={`dj-method dj-method-get`}>GET</span>
  <code>/api/v1/messaging/otp/validate</code>
</div>

Confirm the one-time passcode a user entered against the reference\_id returned by Send OTP. Returns whether the code is correct and still within its expiry window.

## Headers

| Header          | Required | Description                                         |
| --------------- | -------- | --------------------------------------------------- |
| `Authorization` | Yes      | Your app's secret key, sent as-is — *not* `Bearer`. |
| `AppId`         | Yes      | The App ID from your dashboard.                     |

## Query parameters

| Parameter      | Type   | Required | Description                                                                         |
| -------------- | ------ | -------- | ----------------------------------------------------------------------------------- |
| `code`         | string | Yes      | The OTP the user received and entered.                                              |
| `reference_id` | string | Yes      | The `reference_id` returned when you sent the OTP — identifies which code to check. |

## Response

Returns an `entity` whose `valid` flag is `true` when the code matches and has not expired, and `false` otherwise.

| Field   | Type    | Description                                                                        |
| ------- | ------- | ---------------------------------------------------------------------------------- |
| `valid` | boolean | `true` if the code is correct and unexpired; `false` if it is wrong or has lapsed. |

## Errors

| Code  | Meaning                                                            |
| ----- | ------------------------------------------------------------------ |
| `400` | Bad request — `code` or `reference_id` is missing or malformed.    |
| `401` | Unauthorized — check your key and `AppId` (no `Bearer` prefix).    |
| `422` | Unprocessable — the `reference_id` is unknown or already consumed. |
| `429` | Too many requests — back off and retry.                            |

## Sandbox

The OTP is always `1234` in sandbox — test with `code=1234` and the `reference_id` from [Send OTP](/api-reference/messaging/send-otp) against `https://sandbox.dojah.io`. See [Sandbox & test data](/api-reference/get-started/sandbox-test-data) for every test value.

<RequestExample>
  ```bash cURL theme={null}
  curl --request GET \
    "https://api.dojah.io/api/v1/messaging/otp/validate?code=1234&reference_id=edd37ab5-48ec-4481-8cf9-ba5chu7c41f7" \
    -H "Authorization: {{secret_key}}" \
    -H "AppId: {{app_id}}"
  ```

  ```js Node.js theme={null}
  const params = new URLSearchParams({
    "code": "1234",
    "reference_id": "edd37ab5-48ec-4481-8cf9-ba5chu7c41f7",
  });

  const url = "https://api.dojah.io/api/v1/messaging/otp/validate?" + params;
  const res = await fetch(url, {
    headers: {
      Authorization: process.env.DOJAH_SECRET_KEY,
      AppId: process.env.DOJAH_APP_ID,
    },
  });
  const data = await res.json();
  ```

  ```python Python theme={null}
  import os, requests

  res = requests.get(
      "https://api.dojah.io/api/v1/messaging/otp/validate",
      headers={
          "Authorization": os.environ["DOJAH_SECRET_KEY"],
          "AppId": os.environ["DOJAH_APP_ID"],
      },
      params={
          "code": "1234",
          "reference_id": "edd37ab5-48ec-4481-8cf9-ba5chu7c41f7",
      },
  )
  data = res.json()
  ```

  ```php PHP theme={null}
  <?php
  $q = http_build_query([
    "code"         => "1234",
    "reference_id" => "edd37ab5-48ec-4481-8cf9-ba5chu7c41f7",
  ]);
  $ch = curl_init("https://api.dojah.io/api/v1/messaging/otp/validate?" . $q);
  curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
      "Authorization: " . getenv("DOJAH_SECRET_KEY"),
      "AppId: " . getenv("DOJAH_APP_ID"),
    ],
  ]);
  $data = json_decode(curl_exec($ch), true);
  ```
</RequestExample>

<ResponseExample>
  ```json GET /api/v1/messaging/otp/validate theme={null}
  {
    "entity": {
      "valid": true
    }
  }
  ```
</ResponseExample>