m2pfintech
API LibraryOtp Management

Generate a one-time password

Generate and send a one-time password (OTP) to a customer mobile number for verification of secure operations. The OTP is delivered via SMS to the registered mobile number.

The purpose field defines what operation the OTP is for. Supported purposes include SET_PIN (for PIN setting), TRANSACTION (for high-value transactions), LOGIN (for authentication), and CARD_BLOCK (for card blocking confirmation).

The kitNo is required for card-related operations (SET_PIN, CARD_BLOCK) to identify which card the OTP is associated with.

OTPs have a limited validity period (typically 5 minutes) and a maximum of 3 validation attempts. Rate limited to prevent abuse.

POST
/Yappay/otp-manager/generate

Authorization

BearerAuth TenantHeader
AuthorizationBearer <token>

JWT Bearer token obtained from the /auth/login endpoint

In: header

TENANT<token>

Tenant identifier provided by M2P (e.g. ENBDTABBY)

In: header

Request Body

application/json

mobile*string

Customer registered mobile number to send the OTP to

purpose*string

Purpose of the OTP. Determines which operation the OTP authorizes. SET_PIN for PIN setting, TRANSACTION for high-value transactions, LOGIN for authentication, CARD_BLOCK for card blocking.

Value in"SET_PIN" | "TRANSACTION" | "LOGIN" | "CARD_BLOCK"
kitNo?string

Kit number. Required for card-related operations (SET_PIN, CARD_BLOCK).

Response Body

application/json

application/json

application/json

curl -X POST "https://api.m2p.com/Yappay/otp-manager/generate" \  -H "Content-Type: application/json" \  -d '{    "mobile": "9876543210",    "purpose": "SET_PIN",    "kitNo": "KIT20260306001234"  }'
{
  "status": "success",
  "message": "OTP sent successfully"
}

{
  "result": null,
  "exception": {
    "detailMessage": "Not a registered Mobile No",
    "shortMessage": "Not a registered Mobile No",
    "errorCode": "Y216",
    "languageCode": "en"
  },
  "pagination": null
}

{
  "result": null,
  "exception": {
    "detailMessage": "Too many OTP requests. Please wait before retrying.",
    "shortMessage": "OTP rate limit",
    "errorCode": "OTP_004",
    "languageCode": "en"
  },
  "pagination": null
}