OTP application settings reference#

This reference describes the fields and values available when creating or editing an OTP application. The settings are grouped by the sections shown in the DIDWW User Panel. For configuration steps, see Create an OTP application or Manage OTP applications.

General#

The General section identifies the application.

Field	Availability	Description
Application name	Required	Name used to identify the application on the Applications page and in Try it out. The name must be unique within your account.
Description	Optional	Note about the application, shown under its name on the Applications page.
Status	Read-only	Whether the application accepts new verifications. Shown on the View Application page and on the Applications page. Change it with Pause and Resume; see Pause or resume an application.

Status values#

Value	Description
Active	New verification requests are processed as usual.
Paused	Every new verification request is answered with `status` `denied` and `error_code` `application_paused`. The View Application page shows when the application was paused and by whom: Paused by your account or Paused by DIDWW support.

Configuration#

The Configuration section controls how callers authenticate and whether your backend approves each verification. For guidance on choosing a mode, see Authentication.

Field	Availability	Description
Callback URL	Optional, required for `public` requests	URL to which DIDWW sends a `POST` request before the code is sent. Your server replies allow or deny. Enter a valid HTTP or HTTPS URL. The callback URL is required for requests that use `public` authentication. When it is set, it is also called for requests that use `basic` authentication. It is not called for requests that use `application` authentication. See Callbacks.
iOS SMS domain	Optional	Domain added as a last line `@<domain> #<code>` to every SMS of the application, for code autofill on iOS and in browsers. Enter a hostname such as `example.com`, up to 253 characters; it is stored in lowercase. Empty by default. See Domain-bound SMS.
Minimum authentication mode	Required	Weakest authentication mode that callers may use. Stronger modes are always accepted. The default value is Public.

Minimum authentication mode values#

Value	Description
Public	Callers send only the application key, with no secret. Use it for mobile and web applications. Requests that use `public` authentication must be approved by a callback URL. Accepts Public, Basic, and Application requests.
Basic	HTTP Basic authentication. The application key is the username and the application secret is the password. Accepts Basic and Application requests.
Application	The strongest mode. Each request is signed with the application secret (HMAC-SHA256). The callback URL is not called. Accepts Application requests only.

Verification settings#

The Verification settings section controls the verification code. Changes apply to new verifications only.

Field	Availability	Description
Code length	Required	Number of digits in the verification code. Select a value from 4 to 8. The default value is 6.
Code timeout	Required	How long the code stays valid, counted from when the verification starts. The default value is 5 min.
Custom code timeout (secs)	Required, Custom only	Code timeout in seconds. Enter a whole number from 60 to 600. The default value is `300`.

Code timeout values#

Value	Description
1 min, 2 min, 5 min, 10 min	The code stays valid for the selected number of minutes.
Custom	The code stays valid for the number of seconds entered in Custom code timeout (secs), from 60 to 600 seconds.

Volume limits#

The Volume limits section caps how many verifications the application can start, across all its delivery methods. Only allowed starts count. See Set volume limits and Limits.

Field	Availability	Description
Daily limit	Optional	Maximum number of verifications per UTC day. Enter a whole number from 1 to 10,000,000, or leave the field empty for no limit. It must not exceed the monthly limit. The default value is `1000`.
Monthly limit	Optional	Maximum number of verifications per UTC calendar month. Enter a whole number from 1 to 10,000,000, or leave the field empty for no limit. The default value is `15000`.

The View Application page shows the usage of the current day and month next to each limit. While a limit is reached, new verification requests are rejected with 429 volume_limit_reached.

Templates#

The Templates section selects the custom template groups the application uses when a request names no template_group. See Custom templates.

Field	Availability	Description
SMS template group	Optional	SMS template group for SMS verifications that pass no `sms.template_group`. Languages without an approved version use the system template. The default value is System templates.
Voice template group	Optional	Voice template group for phone call verifications that pass no `callout.template_group`. Languages without an approved version use the standard announcement. The default value is System templates.

SMS Settings#

The SMS Settings section selects the sender of OTP messages. For details on SMS delivery, see SMS verification.

Field	Availability	Description
Sender IDs	Optional	Dedicated SMS senders for the OTP traffic of the application. Search for and select senders from the verified senders of your account. A sender is verified per destination country, so each sender is used only for the countries where it is approved. Messages to other countries are sent through DIDWW’s shared senders. Countries that are still under review are listed as pending and become available when approved. If your account has no verified senders, the section shows Get a Sender ID verified, which opens Sender ID verification. See Sender ID Verifications. The default value is DIDWW shared sender IDs.