## What is One-Time Passcode Verification?  
Socure One-Time Passcode (OTP) Verification is a security feature that enables robust two-factor authentication by sending a unique, auto-generated code to a user via **SMS**, **voice call**, or **email**. This code is valid for a single session and is used to verify control of a communication channel or authenticate a user's identity within a workflow.

OTP Verification can be:

- A **standalone check**
- A **building block** in an adaptive risk-based authentication policy

| Enrichment | Description | Region support |
| --- | --- | --- |
| **OTP (One-Time Passcode)** | Standard one-time passcode verification | Global |

## How it works  
- **Generate passcode**: RiskOS™ creates a one-time passcode tied to a session.
- **Deliver via channel**: OTP is sent via SMS, voice, or email.
- **User enters code**: Your app collects the OTP.
- **Verify request**: RiskOS™ validates the submitted OTP against the session.
- **Decision outcome**: API returns `accept`/`reject` plus session metadata.

## What you can do with One-Time Passcode Verification  
- **Secure authentication**: Add OTP as a second factor to reduce account takeover risk.
- **Verify communication channels**: Confirm control of phone numbers and email addresses.
- **Comply with regulations**: Support KYC/AML requirements with step-up authentication.
- **Improve onboarding**: Reduce friction while preventing fraudulent sign-ups.
- **Protect transactions**: Use OTP for high-risk actions such as money transfers or password resets.

## Unique features  
- **Flexible delivery channels**: Send passcodes via SMS, voice, or email.
- **Customizable templates**: Localize and brand SMS and email messages.
- **Configurable limits**  
  - 6-digit codes (default)  
  - 10-minute expiration window  
  - Up to 5 retry attempts  
  - 10-minute cooldown after failures  
- **Global reach**: Support for international phone numbers in **E.164** format.
- **Robust rate limiting**  
  - Up to 5 sends per minute per destination  
  - Up to 10 verification attempts per minute per session  
- **Decision outcomes**— API responses include:
  - `sessionId`  
  - `attemptCount`  
  - `status` (`pending`, `approved`, `reject`)

## Next steps  
[Configure RiskOS™ workflows\
\
Set delivery rules, expiration settings, retry limits, and integrate OTP checks into your workflows.](https://help.socure.com/riskos/docs/otp-riskos-setup)

[Send & verify passcodes\
\
Learn how to generate passcodes, deliver them via SMS, voice, or email, and verify user submissions.](https://help.socure.com/docs/otp-integration-guide)