Launching otp2x.com

Trust at every sign-in. Speed at every check.

Name: OTP2X
Brand: 2X

Verification in two calls: send the code, verify what the user types. Lifetime, length and attempts follow your rules; the code itself is never stored in plain text.

Start free Documentation

The OTP API is launching — live soon. The email channel uses the live sending pipeline, the SMS channel uses TXT2X.

POST /v1/otp/{id}/verify

Enter the verification code

Sent to +90 5** *** ** 67

482913

ttl_seconds: 30004:12

verified: true attempts_left: 4

Code never stored in plain text
otp.send · otp.verify

Illustrative view · sample data

Capabilities

What is ready, what comes next

Every line states its status: use what is live today, help shape what is in early access.

Live

Send and verify

POST /v1/otp creates the code; POST /v1/otp/{id}/verify returns the result and attempts left.

Live

Lifetime and length

Set the code lifetime and digit count with ttl_seconds and length.

Live

Attempt limit

Each verify returns attempts left; the code is invalid once they run out.

Live

No plain text

Neither the code nor the message body is stored; only a keyed hash is kept, never logged.

Live

Separate scopes

otp.send and otp.verify are separate scopes; split sending and verifying services.

Launching

SMS and email channels

Pick with the channel field. Email is live; SMS opens with the operator connection.

Early access

Verification analytics

Success rate, timing and channel breakdown screen.

Early access

Risk signals

Abuse detection with device and IP signals.

Use cases

Where it helps

Sign-in and two-step verification

A short-lived code to phone or email on top of the password.

Phone and email verification

Prove during sign-up that the contact detail really belongs to the user.

Sensitive action approval

Extra confirmation before payments, address changes or account deletion.

Developers

Start with a single request

You neither generate nor store the code: 2X creates, sends and verifies it. Field names are finalized during launch; see /docs for the current shape.

Base URL: https://api.reach2x.com
Bearer API key; permission per scope
Idempotency-Key required on sends
Errors as RFC 9457 problem+json with a stable code

Docs

curl Send a code

curl https://api.reach2x.com/v1/otp \
  -H "Authorization: Bearer $REACH2X_API_KEY" \
  -H "Idempotency-Key: giris-7f3a91c2" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "email",
    "to": "[email protected]",
    "from": "[email protected]",
    "length": 6,
    "ttl_seconds": 300
  }'

Response

{
  "id": "5e4d3c2b-1a09-4f8e-8d7c-6b5a49382716",
  "object": "otp",
  "channel": "email",
  "status": "pending",
  "to": "a***@ornek.com",
  "attempts_left": 5,
  "expires_at": "2026-11-14T09:35:00Z"
}

curl Verify the code

curl https://api.reach2x.com/v1/otp/5e4d3c2b-1a09-4f8e-8d7c-6b5a49382716/verify \
  -H "Authorization: Bearer $REACH2X_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "code": "482913" }'

Response

{
  "verified": true,
  "attempts_left": 4,
  "status": "verified"
}

Security

Secure by default

The points below describe how the API behaves today, not future promises.

Scoped API keys

Each key belongs to one project and can only use the scopes it was given (e.g. sms.send, email.read). Only a hash is stored; the secret is shown once.

Tenant isolation

Asking for an id that belongs to another organization returns 404; nothing about its existence leaks.

Idempotency

Sending calls require an Idempotency-Key. A repeated request with the same key returns the original result instead of a second message.

Signed webhooks

Every event is signed with HMAC-SHA256 and carries a timestamp; failed deliveries are retried with growing intervals.

Masked recipients

Phone numbers and email addresses are masked in responses; message bodies can never be read back through the API.

Test keys

Keys starting with rx_test_ never deliver to a real recipient, so you can try your integration safely.

Pricing

Early access — pricing soon

The price list is not published yet. Open your account now, start on a trial entitlement and see the plans first when they are announced.

One product

Only the channel you need. No separate account, no separate portal.

Pricing soonEarly access

Several products

Add products to the same organization; keys, members and logs stay shared.

Pricing soonEarly access

The whole 2X family

Email, SMS, verification and the next channels under one organization.

Pricing soonEarly access

FAQ

Frequently asked questions

When will OTP2X go live?

The API is being built this period and is in launch phase. The email channel is expected first since it uses the live sending pipeline; no date is announced.

Do we generate the code?

No. 2X generates the code and keeps only its hash; you just forward what the user typed to the verify endpoint.

Can I send codes over WhatsApp or push?

The planned channels today are SMS and email. Others will be considered as those products open.

What does it cost?

The price list is not published yet.

2X family