One OTP API.
Your way to build.

# Set WHATSOS_OTP_KEY securely in this backend shell first.
# Extract the starter ZIP; keep the CLI and Node client together.
node whatsos-otp-cli.mjs send \
  --to +12025550123 --purpose phone_verification \
  --request-id unique-send-attempt-001

# Replace the ID with the saved send response. Sandbox only:
printf '123456' | node whatsos-otp-cli.mjs check \
  --id ver_REPLACE_WITH_SAVED_ID --code-stdin \
  --request-id unique-check-attempt-001

# WHATSOS_OTP_KEY must already be set in the process environment.
node .\whatsos-otp-cli.mjs send --to +12025550123 --purpose phone_verification --request-id unique-send-attempt-001
# Sandbox only. Replace the ID from the send response:
'123456' | node .\whatsos-otp-cli.mjs check --id ver_REPLACE_WITH_SAVED_ID --code-stdin --request-id unique-check-attempt-001

import { WhatsosOtp } from './whatsos-otp.mjs';
const otp = new WhatsosOtp({
  origin: 'https://whatsos.com', apiKey: process.env.WHATSOS_OTP_KEY
});
// attempt is loaded from YOUR server-side action/session store.
// Persist each operation key before calling the API.
const sent = await otp.send({
  to: attempt.phone, purpose: 'phone_verification',
  locale: 'en_US', reference: attempt.id
}, attempt.sendKey);
// Save sent.verification_id in that same attempt.

// In your separate check handler, load the bound attempt again:
const result = await otp.check(
  attempt.verificationId, userEnteredCode, attempt.checkKey
);
if (result.verified === true && result.status === 'verified') {
  // Atomically complete this bound action ONCE in your database.
}

import os
from whatsos_otp import WhatsosOtp, WhatsosOtpError
otp = WhatsosOtp(os.environ['WHATSOS_OTP_KEY'])
# attempt comes from YOUR server-side action/session store.
try:
    sent = otp.send(attempt['phone'], 'phone_verification',
                    request_id=attempt['send_key'], reference=attempt['id'])
    # Persist sent['verification_id'] in this attempt.
    # Later, in the check handler, load the bound attempt:
    result = otp.check(attempt['verification_id'], user_entered_code,
                       request_id=attempt['check_key'])
    if result.get('verified') is True and result.get('status') == 'verified':
        pass  # Complete the bound action once in your database.
except WhatsosOtpError as error:
    # Use error.status, error.code and error.retry_after to choose recovery.
    raise
# Transport failures: retain the exact request_id and body for retry.

// PHP backend: cURL extension required.
function otp_post(string $path, array $body, string $requestId): array {
    $key = getenv('WHATSOS_OTP_KEY');
    if (!$key) throw new RuntimeException('OTP key is not configured');
    $ch = curl_init('https://whatsos.com/api/v1/otp' . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15, CURLOPT_FOLLOWLOCATION => false,
        CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $key,
            'Content-Type: application/json', 'Idempotency-Key: ' . $requestId],
        CURLOPT_POSTFIELDS => json_encode($body, JSON_THROW_ON_ERROR)
    ]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    curl_close($ch);
    if ($raw === false) throw new RuntimeException('Uncertain request; preserve operation key');
    $data = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
    if ($status < 200 || $status >= 300) {
        throw new RuntimeException('OTP request rejected; HTTP ' . $status);
    }
    return $data;
}
// $attempt must come from your server-side session, not a browser ID.
$result = otp_post('/verifications/' . rawurlencode($attempt['verification_id'])
    . '/check', ['code' => $userEnteredCode], $attempt['check_key']);
if (($result['verified'] ?? false) === true && ($result['status'] ?? '') === 'verified') {
    // Atomically complete the matching action once.
}

// Inside YOUR protected WordPress server handler:
// Validate authorization, business input and the action's CSRF token first.
// Load the expected phone from the action you intend to approve.
$proof = whatsos_otp_consume($expected_phone, 'phone_verification');
if (is_wp_error($proof)) {
    return $proof; // Stop. The phone is not verified for this action.
}
// Complete the matching action once; record its unique completion ID.
// Test proofs are rejected by default.

Implement WhatsOS WhatsApp OTP phone verification in this project.
Read https://whatsos.com/otp/ai-integration.txt and
https://whatsos.com/otp/openapi.json first.
Use WHATSOS_OTP_KEY only on the backend and begin with a test project.
Bind phone, purpose, environment and verification ID to a server-side
action session. Add send, check, resend and cancel handling.
Reuse operation keys only for the same uncertain request; replace the
stored verification ID after resend. Require verified=true and
status=verified, then atomically complete the bound action once.
Add CSRF protection, request limits and tests for incorrect, expired,
replayed and cross-session codes. Do not send live messages while building.
For WordPress, use the plugin's server-side whatsos_otp_consume() function.