OTP Login - Prelude Docs

This guide walks you through configuring OTP (one-time password) login for your application using Prelude Auth. OTP login sends a verification code to the user’s phone number via SMS or to their email address.

Prerequisites

Before you start, make sure you have:

A Prelude account with access to Prelude Auth
An Application ID (appID): see Applications
Your Management API key for backend calls
A configured Verify template for sending OTP codes

1

Create an OTP login configuration

curl -X POST https://api.prelude.dev/v2/session/apps/${APP_ID}/config/login/otp \
  -H "Authorization: Bearer ${MANAGEMENT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "config_type": "otp",
    "channel_type": "sms",
    "is_default": true
  }'

Field	Required	Description
`config_type`	Yes	Must be `"otp"`.
`channel_type`	Yes	The channel used for OTP delivery (`"sms"` or `"email"`).
`is_default`	Yes	Whether this is the default OTP login configuration.
`template_id`	No	The ID of your Verify template. This controls the OTP message content and delivery settings.
`sender_id`	No	The sender ID used for SMS delivery.
`code_size`	No	OTP code length (number of digits), between `4` and `8`. Applied to verifications created through this login configuration. When omitted, your account’s default code size applies.
`granted_scopes`	No	List of session scopes attached to the session when a login completes through this OTP configuration (for example `["prld:pwd:write"]` to grant a password change). Defaults to an empty list.

This configuration supports both SMS and email channels simultaneously, so a user can receive the OTP either way.

What’s next?

Now that OTP login is configured on your backend, integrate the frontend using the OTP Login guide.