How does the OTP API work?

Two calls: POST /v1/otp/send generates and texts a passcode and returns a verification_id; POST /v1/otp/verify checks the code the user entered against that verification_id and returns whether it matched. Bremlio handles code generation, delivery, expiry and attempt limits.

Each OTP is one SMS at 4.65p to a UK mobile, pay as you go. No monthly fee. New accounts get 25 free credits.

Do you protect against brute-force and reuse?

Yes. Codes expire, verification attempts are capped, and a code cannot be reused after it has been successfully verified.

Can I use it for 2FA and passwordless login?

Yes — the send/verify flow is suitable for two-factor authentication, phone verification and passwordless login for UK apps.

Home › OTP API

OTP API

Name: Bremlio OTP API
Brand: Bremlio
Price: 0.0465 GBP
Availability: InStock

Send and verify one-time passcodes with two API calls. Bremlio generates the code, delivers it by SMS, and handles expiry and brute-force protection — so you don't have to. Pay as you go at 4.65p per passcode SMS.

Bremlio's OTP API, operated by Bremlio Ltd, is a UK one-time-passcode API for phone verification, two-factor authentication (2FA) and passwordless login. You send a passcode to a UK mobile and later verify what the user typed — Bremlio manages the code, its delivery, its expiry and the attempt limits.

Get your API key free

How it works — two calls

1. Send a passcode

# POST /v1/otp/send — Bremlio generates + texts the code
curl -X POST "https://api.bremlio.com/v1/otp/send" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"to": "+447700900123"}'

# → {"verification_id": "…"}   (store this against the user)

2. Verify the code the user entered

# POST /v1/otp/verify
curl -X POST "https://api.bremlio.com/v1/otp/verify" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -d '{"verification_id": "…", "code": "123456"}'

# → {"verified": true}   (or {"error": "invalid code"} / "code expired")

Node.js

const send = await fetch("https://api.bremlio.com/v1/otp/send", {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-Api-Key": process.env.BREMLIO_API_KEY },
  body: JSON.stringify({ to: "+447700900123" }),
});
const { verification_id } = await send.json();
// later, when the user submits their code:
const check = await fetch("https://api.bremlio.com/v1/otp/verify", {
  method: "POST",
  headers: { "Content-Type": "application/json", "X-Api-Key": process.env.BREMLIO_API_KEY },
  body: JSON.stringify({ verification_id, code: userInput }),
});
const { verified } = await check.json();

What's handled for you

Code generation — a fresh numeric passcode per request.
Delivery — sent by SMS to the UK mobile, with delivery status tracked.
Expiry — codes time out, so stale codes can't be used.
Brute-force protection — verification attempts are capped.
Single use — a code can't be reused once successfully verified.

Pricing

Item	Cost
Each OTP (one SMS to a UK mobile)	4.65p
Monthly fee	None
Free credits on signup	25
Minimum top-up	£10

An OTP is charged as one SMS. See full pricing.

Frequently asked questions

How does the OTP API work?: Two calls: /v1/otp/send texts a passcode and returns a verification_id; /v1/otp/verify checks the user's code against it. Bremlio handles generation, delivery, expiry and attempt limits.
What does OTP cost?: Each OTP is one SMS at 4.65p to a UK mobile, pay as you go. No monthly fee; 25 free credits on signup.
Do you protect against brute-force and reuse?: Yes — codes expire, attempts are capped, and a code can't be reused after a successful verification.
Can I use it for 2FA and passwordless login?: Yes — the flow suits two-factor authentication, phone verification and passwordless login for UK apps.

Add phone verification to your app today.