API documentation

You know the user’s number. Blasty sends them a code; they type it into your app; you check it.

1. 1

   Start it from your server

   Send the user’s number. Blasty charges 1 credit and queues the code from your number (the one the key is pinned to, device_id, or your default). Keep the id: the code itself is never returned, so it can’t leak through your app.

   Request

   curl -X POST https://blasty.my/api/v1/otp \
     -H "Authorization: Bearer <your-api-key>" \
     -H "Accept: application/json" \
     -H "Content-Type: application/json" \
     -d '{"mode":"normal","phone":"0123456789","reference":"signup-42","callback_url":"https://your-app.example/otp-hook"}'

   Response 201 Created

   {
     "data": {
       "id": 1042,
       "mode": "normal",
       "status": "pending",
       "phone": "60123456789",
       "verified_phone": null,
       "device_id": 2,
       "language": "en",
       "reference": "signup-42",
       "attempts_left": 5,
       "expires_at": "2026-10-13T09:20:00+00:00",
       "verified_at": null,
       "created_at": "2026-10-13T09:15:00+00:00"
     }
   }

2. 2

   The user gets the code on WhatsApp

   From a QR number it reads like this (in Malay with "language": "ms"; app_name adds a [YourApp] prefix). From a Meta number it goes out as your approved blasty_otp authentication template, in Meta’s wording with a Copy code button: set it up on the OTP page first.

   482913 is your verification code. It expires in 5 minutes. Do not share it with anyone.

   482913 ialah kod pengesahan anda. Sah selama 5 minit. Jangan kongsi kod ini dengan sesiapa.
3. 3

   Check the code the user typed

   Every call uses one attempt, right or wrong. The right code answers 200 and the OTP is verified; anything else answers 422 with a reason. After 5 wrong codes the OTP locks (failed) and you start a new one.

   Request

   curl -X POST https://blasty.my/api/v1/otp/1042/verify \
     -H "Authorization: Bearer <your-api-key>" \
     -H "Accept: application/json" \
     -H "Content-Type: application/json" \
     -d '{"code":"482913"}'

   Response 200 OK

   {
     "verified": true,
     "reason": null,
     "attempts_left": 4,
     "data": {
       "id": 1042,
       "mode": "normal",
       "status": "verified",
       "phone": "60123456789",
       "verified_phone": "60123456789",
       "device_id": 2,
       "language": "en",
       "reference": "signup-42",
       "attempts_left": 4,
       "expires_at": "2026-10-13T09:20:00+00:00",
       "verified_at": "2026-10-13T09:16:12+00:00",
       "created_at": "2026-10-13T09:15:00+00:00"
     }
   }

   Wrong code 422 Unprocessable

   {
     "verified": false,
     "reason": "incorrect",
     "attempts_left": 4,
     "data": {
       "id": 1042,
       "mode": "normal",
       "status": "pending",
       "phone": "60123456789",
       "verified_phone": null,
       "device_id": 2,
       "language": "en",
       "reference": "signup-42",
       "attempts_left": 4,
       "expires_at": "2026-10-13T09:20:00+00:00",
       "verified_at": null,
       "created_at": "2026-10-13T09:15:00+00:00"
     }
   }

4. 4

   Optionally, let Blasty call you

   With a callback_url your server also gets otp.verified, or otp.expired if the user never finishes. In normal mode the verify answer already tells you, so this is mostly for logging and clean-up. See Callbacks.

You don’t need the number. The user sends a code to your WhatsApp number in one tap; Blasty tells you which number sent it.

1. 1

   Start it from your server

   No phone needed. The answer adds the code, the ready-made text, a one-tap link and the whatsapp_number to message. These four come back only in this response. 1 credit, taken now (it also pays for the ✅ reply). Already know the number? Pass phone and only a message from it counts.

   Request

   curl -X POST https://blasty.my/api/v1/otp \
     -H "Authorization: Bearer <your-api-key>" \
     -H "Accept: application/json" \
     -H "Content-Type: application/json" \
     -d '{"mode":"reverse","reference":"login-77","callback_url":"https://your-app.example/otp-hook"}'

   Response 201 Created

   {
     "data": {
       "id": 1043,
       "mode": "reverse",
       "status": "pending",
       "phone": null,
       "verified_phone": null,
       "device_id": 2,
       "language": "en",
       "reference": "login-77",
       "attempts_left": null,
       "expires_at": "2026-10-13T09:20:00+00:00",
       "verified_at": null,
       "created_at": "2026-10-13T09:15:00+00:00"
     },
     "code": "K7Q2MX",
     "text": "My verification code is K7Q2MX",
     "link": "https://wa.me/60111111111?text=My%20verification%20code%20is%20K7Q2MX",
     "whatsapp_number": "60111111111"
   }

2. 2

   Show the link

   On a phone, a button that opens WhatsApp with the message ready. On a computer, show the same link as a QR code to scan with the phone, plus the text and whatsapp_number for anyone who prefers to type it.

   HTML

   <a href="https://wa.me/60111111111?text=My%20verification%20code%20is%20K7Q2MX">Verify with WhatsApp</a>

3. 3

   The user taps Send

   Blasty finds the code anywhere in the message, in any letter case, marks the OTP verified and records the sender as verified_phone. The ✅ reply is already paid for, your AI agent stays quiet, and the code is masked in your message log. A code sent from one of your own connected numbers is ignored.

   My verification code is K7Q2MX

   ✅ Verified. You can go back to the app now.
4. 4

   Find out it’s done

   Poll GET /otp/{id} from your server every 2–3 seconds while your page waits, until status is no longer pending (give up at expires_at), or wait for the otp.verified callback. Then sign the user in as verified_phone.

   Request

   curl https://blasty.my/api/v1/otp/1043 \
     -H "Authorization: Bearer <your-api-key>" \
     -H "Accept: application/json"

   Response 200 OK

   {
     "data": {
       "id": 1043,
       "mode": "reverse",
       "status": "verified",
       "phone": null,
       "verified_phone": "60123456789",
       "device_id": 2,
       "language": "en",
       "reference": "login-77",
       "attempts_left": null,
       "expires_at": "2026-10-13T09:20:00+00:00",
       "verified_at": "2026-10-13T09:15:41+00:00",
       "created_at": "2026-10-13T09:15:00+00:00"
     }
   }