---
title: "Verify SMS OTP"
method: POST
path: "/api/checkout/v1/otp/verify/"
tags: ["api"]
---

# Verify SMS OTP

`POST /api/checkout/v1/otp/verify/`

**Headless checkouts only.** This is a non-standard endpoint for headless integrations where the merchant drives phone verification server-to-server. In a typical hosted checkout the customer completes phone verification themselves and this endpoint must not be used.

Verifies a one-time password the customer received by SMS for the given contract. Returns whether the code was valid; on success the phone number is marked as verified.

## Request body

- OtpVerifyRequest
  - `external_contract_uuid` string, uuid, required — The external contract UUID of the application to verify the OTP for
  - `verification_code` string, required — The one-time code the customer received by SMS

## Response `200`

- OtpVerifyResponse
  - `verified` boolean, required — Whether the supplied code was valid
  - `external_contract_uuid` string, uuid, required — The external contract UUID that was processed
  - `reason` string — Reason the code was not accepted (e.g. 'invalid'); empty when verified

## Other responses

- `400`
- `404`
- `429`

---

[API](https://skmtc.net/heylight/apis/heidipay-checkout-api.md) · [All operations](https://skmtc.net/heylight/apis/heidipay-checkout-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/heylight/heidipay-checkout-api/versions/c51570cfc888/schema)