---
title: "Authenticate a user by sending them a One-Time Password over email or SMS."
method: POST
path: "/otp"
tags: ["auth"]
---

# Authenticate a user by sending them a One-Time Password over email or SMS.

`POST /otp`

## Request body

- object
  - `email` string, email
  - `phone` string, phone
  - `channel` 'sms' | 'whatsapp'
  - `create_user` boolean
  - `data` object
  - `code_challenge_method` 's256' | 'plain'
  - `code_challenge` string
  - `gotrue_meta_security` GoTrueSecurity — Use this property to pass a CAPTCHA token only if you have enabled CAPTCHA protection.
    - `captcha_token` string

## Response `200`

A One-Time Password was sent to the email or phone. To obfuscate whether such an address or number already exists in the system this response is sent in both cases.

- object
  - `message_id` string — Unique ID of the message as reported by the SMS sending provider. Useful for tracking deliverability problems.

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `422` — Returned when unable to validate the email or phone number.
- `429` — HTTP Too Many Requests response, when a rate limiter has been breached.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)