CAMARA · GSMA Open Gateway

Camara OTP API

Send and check one-time passcodes by SMS

One Time Password SMS API is used to send short-lived OTPs (one time passwords) to a phone number via SMS and validate it afterwards, in order to provide a proof of possession of the phone number.

  • Two-factor login
  • Transaction approval
  • Phone ownership

What you can do with this API

Ready to test? Jump to the sample call and the API reference, where you can try every endpoint. Start testing
Read the full API overview

Camara OTP
 

What is OTP Validation API?

OTP Validation API

One Time Password SMS API is used to send short-lived OTPs (one time passwords) to a phone number via SMS and validate it afterwards, in order to provide a proof of possession of the phone number.

Overview of the Ooredoo OTP Validation CAMARA API

High level definition

One Time Password SMS API performs real-time checks to verify that the user possessed the device that carries the indicated mobile phone number. It provides a frequent method of verifying possession of the device by delivering an OTP (one-time password) through SMS and validating it afterwards.

API Operations

Two endpoints are defined in One Time Password SMS API:

  • POST send-code : Sends an SMS with the desired message and an OTP code to the received phone number
  • POST validate-code : Verifies the received code as input is valid for the given authenticationId.

One Time Password SMS API is a secure method for providing one-time access to an application or performing a single transaction. OTP is most effective and legitimate for a single transaction, unlike user-generated passwords. It is a secure authentication method where a text containing a unique alphanumeric or numeric code is sent to a mobile number (MSISDM).

An One Time Password SMS API is a unique, time-sensitive code used for a single login or transaction. Unlike static passwords, which remain constant and vulnerable to compromise, OTPs expire quickly, enhancing security. This dynamic nature makes them a powerful tool against unauthorized access.

OTPs significantly enhance the security of online transactions. In online banking, they add an extra layer of protection for sensitive financial activities. E-commerce platforms utilize OTPs during checkout to deter fraudsters. Furthermore, service providers rely on OTPs to safeguard access to critical systems.

One-Time Passcodes are also integral to two-factor authentication (2FA) and password recovery processes. They ensure that only the legitimate account owner can access their account or initiate password resets. Ultimately, OTPs play a crucial role in minimizing the risk of cyberattacks and data breaches

Questions about the Camara OTP API

What can I do with the Camara OTP API?

One Time Password SMS API is used to send short-lived OTPs (one time passwords) to a phone number via SMS and validate it afterwards, in order to provide a proof of possession of the phone number.

  • Send a one-time code by SMS (POST /send-code)
  • Is the code the user entered correct? (POST /validate-code)
Which inputs does each call to the Camara OTP API need?
  • POST /send-code: requires phoneNumber, message
  • POST /validate-code: requires authenticationId, code

Every call also needs Authorization: Bearer <access_token>. The API reference on this page shows each field's type and an example request.

What does the Camara OTP API return?
  • POST /send-code returns HTTP 200 with authenticationId

Responses are JSON.

How do I authenticate with the Camara OTP API?
  1. Call POST https://api.ooredoo.com/oauth/v4/token with client_id, client_secret in the headers. Send grant_type, scope in the body. Use the client ID and secret of your app.
  2. The response contains access_token, token_type, expires_in, consented_on, created_At, expired_At.
  3. Send Authorization: Bearer <access_token> on each call until the token expires, then request a new one.
Which errors can the Camara OTP API return?
  • 400: Problem with the client request
  • 401: Authentication problem with the client request
  • 403: Client does not have sufficient permissions to perform this action.
  • 404: Resource Not Found
  • 406: The server can not produce a response matching the content
  • 415: The server refuses to accept the request because the payload format is in an unsupported format
  • 429: Either out of resource quota or reaching rate limiting
  • 500: Server error
  • 503: Service unavailable.
  • 504: Request time exceeded.

On 401, request a new access token and retry.

Where is the Camara OTP API available?

Camara OTP is available in Algeria, Iraq, Kuwait, Maldives, Oman, Palestine, Tunisia and Qatar.

Which standard does the Camara OTP API follow?

It follows the CAMARA specification of the GSMA Open Gateway initiative, so an integration built for another operator's CAMARA API needs little change. See our CAMARA certification page.

Related APIs

Sample call

From the published OpenAPI specification. Replace the placeholders with your app's credentials and real values.

1. Get an access token

curl -X POST https://api.ooredoo.com/oauth/v4/token \
  -H "client_id: $CLIENT_ID" \
  -H "client_secret: $CLIENT_SECRET" \
  -d "grant_type=client_credentials" \
  -d "scope=urn:mdv:camaraotp"

2. Call the API

curl -X POST https://api.ooredoo.com/one-time-password-sms/v4/send-code \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "phoneNumber": "+974XXXXXXXX",
    "message": "{{code}} is your short code to authenticate with Cool App via SMS"
  }'

API reference

Try any endpoint in the sandbox