One Time Password as a Service

A One Time Password or OTP is a security code designed to be used for a single login attempt, to minimise the risk of fraudulent login attempts and maintain high security. It’s a string of characters or numbers automatically generated and sent to the user’s phone via SMS, Voice or Push message.

The OTP has become the standard method worldwide of enabling a login when special circumstances apply, such as validating a new account or confirming a transaction is legitimate.

Providers like CM.com offer OTPs as a service, with a secure platform for receiving or initiating OTP requests, sending the OTP as a text or other channel, and verifying the OTP was entered correctly, so the transaction can go ahead.

The infrastructure for making use of one-time passwords integrates with your website or application using an API. This is how a site “knows” whether an entered OTP is correct or not, with safeguards like checking it’s within the time window.

There are several ways to send an OTP. Some give the option of receiving OTPs by email, although this tends to be less secure. Other providers even enable OTPs as voicemails, stating the PIN aloud when the customer checks the mailbox.

But by far the most common way to send OTPs is by Push or text messaging, typically an SMS or even WhatsApp message to the customer’s mobile phone.

An OTP is generated automatically as a semi-random number or string of characters. There is no way to predict what the OTP will be ahead of time. OTPs are valid for a single login session or transaction, enhancing security by reducing the risk of unauthorised access even if the password is intercepted. Once used, the OTP expires, ensuring it cannot be reused for future logins or transactions.