OTP Verification API in PHP: Complete Working Example

PHP still powers a huge share of small stores, panels and reseller sites, so a clean OTP verification API in PHP example is useful. Below is a compact script that orders a number, waits for the SMS code and cancels when nothing arrives.

Short answer: call the handler URL with action=getNumber, split the reply on colons to get the order ID and number, loop on getStatus until STATUS_OK, then complete the order. Cancel it if the time limit passes.

Before you begin

• Create an account and copy your API key.
• Find your service and country IDs with getServices and getCountries.
• Make sure cURL is enabled in PHP.

Example

<?php
$apiKey = getenv('OTPGET_API_KEY');
$base = 'https://otpget.com/stubs/handler_api.php';

function call($base, $apiKey, $action, $params = []) {
    $params['api_key'] = $apiKey;
    $params['action'] = $action;
    $ch = curl_init($base . '?' . http_build_query($params));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 20);
    $out = curl_exec($ch);
    curl_close($ch);
    return trim((string)$out);
}

$reply = call($base, $apiKey, 'getNumber', ['service' => 'SERVICE_ID', 'country' => 'COUNTRY_ID', 'type' => 1]);
if (strpos($reply, 'ACCESS_NUMBER') !== 0) { exit('Order failed: ' . $reply); }
list(, $orderId, $number, $price) = explode(':', $reply);
echo 'Use this number: ' . $number . PHP_EOL;

$deadline = time() + 120;
while (time() < $deadline) {
    $status = call($base, $apiKey, 'getStatus', ['id' => $orderId]);
    if (strpos($status, 'STATUS_OK') === 0) {
        $code = explode(':', $status, 2)[1];
        call($base, $apiKey, 'setStatus', ['id' => $orderId, 'status' => 6]);
        exit('Code: ' . $code);
    }
    if ($status === 'STATUS_CANCEL') { exit('Cancelled'); }
    sleep(5);
}
call($base, $apiKey, 'setStatus', ['id' => $orderId, 'status' => 8]);
echo 'Timed out and cancelled';

Notes on the replies

• A success reply looks like ACCESS_NUMBER, then the order ID, the number and the price.
• STATUS_WAIT_CODE means keep waiting; STATUS_OK carries the code.
• BAD_KEY, NO_BALANCE and BAD_SERVICE are error replies. Stop and fix them instead of looping.
• Status 8 cancels and refunds, allowed two minutes after the purchase.

Full details are in the documentation.

Safe-use tips

• Store the key in an environment variable or a protected config file.
• Never echo the key in logs or pages.
• Run the polling loop in a background job, not inside a web request that a user can reload.
• Add a daily spending limit in your own code.

Using it inside a larger PHP project

If you run a panel or a store, do not call the API from the page the user is looking at. A user who refreshes during the wait would start a second order. Instead, write the order to a table, let a cron job or a queue worker call the API, and have the page read the order status from your own database. This also gives you a place to record the code, the time and the result for support questions.

Security checklist

• Keep the key out of the web root and out of version control.
• Validate service and country IDs against a list you trust before sending them.
• Never print raw API replies to the browser.
• Limit how many orders one user can place per hour.
• Log failures without logging the key.

These small rules prevent the most common ways a reseller panel loses money.

Frequently Asked Questions

Can I use file_get_contents instead of cURL?

Yes, for simple cases, but cURL gives you timeouts and error handling.

What does the price value mean?

It is the amount charged, in PKR unless you ask for another currency.

Can I build a reseller panel on this?

Yes. Read the reseller rules in the terms first.

Is there a JSON option?

Some endpoints reply in JSON. The SMS ordering endpoint uses plain text.

Conclusion

Order, poll, complete or cancel, with the key kept safe. Create your account to start, and see the OTP API overview.