One-Time Passcode (OTP)
What is One-Time Passcode Verification?
Socure One-Time Passcode (OTP) Verification is a security feature that enables robust two-factor authentication by sending a unique, auto-generated code to a user via SMS, voice call, or email. This code is valid for a single session and is used to verify control of a communication channel or authenticate a user's identity within a workflow.
OTP Verification can be:
- A standalone check
- A building block in an adaptive risk-based authentication policy
| Enrichment | Description | Region support |
|---|---|---|
| OTP (One-Time Passcode) | Standard one-time passcode verification | Global |
How it works
- Generate passcode: RiskOS™ creates a one-time passcode tied to a session.
- Deliver via channel: OTP is sent via SMS, voice, or email.
- User enters code: Your app collects the OTP.
- Verify request: RiskOS™ validates the submitted OTP against the session.
- Decision outcome: API returns
accept/rejectplus session metadata.
What you can do with One-Time Passcode Verification
- Secure authentication: Add OTP as a second factor to reduce account takeover risk.
- Verify communication channels: Confirm control of phone numbers and email addresses.
- Comply with regulations: Support KYC/AML requirements with step-up authentication.
- Improve onboarding: Reduce friction while preventing fraudulent sign-ups.
- Protect transactions: Use OTP for high-risk actions such as money transfers or password resets.
Unique features
- Flexible delivery channels: Send passcodes via SMS, voice, or email.
- Customizable templates: Localize and brand SMS and email messages.
- Configurable limits
- 6-digit codes (default)
- 10-minute expiration window
- Up to 5 retry attempts
- 10-minute cooldown after failures
- Global reach: Support for international phone numbers in E.164 format.
- Robust rate limiting
- Up to 5 sends per minute per destination
- Up to 10 verification attempts per minute per session
- Decision outcomes— API responses include:
sessionIdattemptCountstatus(pending,approved,reject)
Next steps
[Configure RiskOS™ workflows
Set delivery rules, expiration settings, retry limits, and integrate OTP checks into your workflows.](https://help.socure.com/riskos/docs/otp-riskos-setup)
[Send & verify passcodes
Learn how to generate passcodes, deliver them via SMS, voice, or email, and verify user submissions.](https://help.socure.com/docs/otp-integration-guide)