WhatsOS OTP integration starter, version 1.0.0

Docs: https://whatsos.com/otp/integrations.html
API base: https://whatsos.com/api/v1/otp
Workspace: https://whatsos.com/otp

FILES
whatsos-otp.mjs         Node.js 18+ backend client and signed webhook helper
whatsos-otp-cli.mjs     CLI, requires the Node client in the same folder
whatsos_otp.py          Python 3.10+ standard-library backend client
openapi.json           OpenAPI 3.0 contract for API clients and coding tools
ai-integration.txt     Implementation context for AI-assisted development

QUICK START
Create a scoped test key in your OTP project. Set WHATSOS_OTP_KEY in the backend process environment using your secret manager. Never put it in a command argument or public code. Run:

node whatsos-otp-cli.mjs --help
node whatsos-otp-cli.mjs send --to +12025550123 --purpose phone_verification --request-id unique-send-attempt-001

Save the returned verification_id. To check a sandbox challenge in Bash:
printf '123456' | node whatsos-otp-cli.mjs check --id ver_REPLACE_WITH_SAVED_ID --code-stdin --request-id unique-check-attempt-001

PowerShell sandbox equivalent:
'123456' | node .\whatsos-otp-cli.mjs check --id ver_REPLACE_WITH_SAVED_ID --code-stdin --request-id unique-check-attempt-001

123456 is only a simulated sandbox code. For live requests, read the user's code through your application or secure stdin; do not place it in shell history. CLI JSON goes to stdout; errors go to stderr. Exit 0: successful operation/verified check; 2: unverified check; 1: error. Treat output containing customer metadata as private.

get, resend and cancel are also supported. Mutations require --request-id, 8-128 characters using letters, digits, dot, colon, dash or underscore. Use a unique ID for each operation, store it before sending, and preserve it with the exact payload for uncertain retries. After a definitive rejected operation (e.g. a 429), honor Retry-After, then start a new attempt with a new ID. Never reuse an ID with a different payload. No client retries automatically.

GET needs otp:read. Send/resend need otp:send. Check needs otp:verify. Cancel needs otp:cancel. Test and live credentials are separate. Live requests require the project, sender/template and licence to be ready. Meta messages are billed separately.

APPLICATION INTEGRATION
Keep all calls on your backend. Bind the verification ID, expected phone, purpose, environment and unique action attempt to a server session. After resend, replace the stored ID with the new returned ID. On check, require verified === true and status === 'verified'; complete the bound application action once. A replayed successful check is not permission to repeat the business action. Do not accept an arbitrary verification ID from the browser or let a test key authorize production activity. Apply application CSRF protection and rate limits. Handle expired/locked codes and unknown network outcomes explicitly.

WordPress installable plugin is a separate download:
https://whatsos.com/otp/downloads/whatsos-otp-wordpress-1.0.0.zip

AI-assisted tools can read ai-integration.txt and openapi.json to generate a backend integration. They are instructions and a contract, not a hosted MCP server or an automatic connector. Keep keys out of prompts and only send OTPs explicitly requested by the recipient.
