# OTP application settings reference

This reference describes the fields and values available when creating or editing an OTP
application. The settings are grouped by the sections shown in the DIDWW User Panel. For
configuration steps, see [Create an OTP application](getting-started.html#otp-verification-create-application) or
[Manage OTP applications](manage-applications.html#otp-verification-manage-applications).

## General

The **General** section identifies the application.

| Field | Availability | Description |
| --- | --- | --- |
| Application name | Required | Name used to identify the application on the **Applications** page and in **Try it out**. The name must be unique within your account. |
| Description | Optional | Note about the application, shown under its name on the **Applications** page. |

## Configuration

The **Configuration** section controls how callers authenticate and whether your backend
approves each verification. For guidance on choosing a mode, see
[Authentication](authentication.html#otp-verification-authentication).

| Field | Availability | Description |
| --- | --- | --- |
| Callback URL | Optional, required for `public` requests | URL to which DIDWW sends a `POST` request before the code is sent. Your server replies allow or deny. Enter a valid HTTP or HTTPS URL. The callback URL is required for requests that use `public` authentication. When it is set, it is also called for requests that use `basic` authentication. It is not called for requests that use `application` authentication. See [Callbacks](callbacks.html#otp-verification-callbacks). |
| [Minimum authentication mode](#otp-verification-reference-auth-modes) | Required | Weakest authentication mode that callers may use. Stronger modes are always accepted. The default value is **Public**. |

### Minimum authentication mode values

| Value | Description |
| --- | --- |
| Public | Callers send only the application key, with no secret. Use it for mobile and web applications. Requests that use `public` authentication must be approved by a callback URL. Accepts **Public**, **Basic**, and **Application** requests. |
| Basic | HTTP Basic authentication. The application key is the username and the application secret is the password. Accepts **Basic** and **Application** requests. |
| Application | The strongest mode. Each request is signed with the application secret (HMAC-SHA256). The callback URL is not called. Accepts **Application** requests only. |

## Verification settings

The **Verification settings** section controls the verification code. Changes apply to new
verifications only.

| Field | Availability | Description |
| --- | --- | --- |
| Code length | Required | Number of digits in the verification code. Select a value from 4 to 8. The default value is **6**. |
| [Code timeout](#otp-verification-reference-code-timeout-values) | Required | How long the code stays valid, counted from when the verification starts. The default value is **5 min**. |
| Custom code timeout (secs) | Required, **Custom** only | Code timeout in seconds. Enter a whole number from 60 to 600. The default value is `300`. |

### Code timeout values

| Value | Description |
| --- | --- |
| 1 min, 2 min, 5 min, 10 min | The code stays valid for the selected number of minutes. |
| Custom | The code stays valid for the number of seconds entered in **Custom code timeout (secs)**, from 60 to 600 seconds. |

## SMS Settings

The **SMS Settings** section selects the sender of OTP messages. For details on SMS
delivery, see [SMS verification](verification-methods/sms.html#otp-verification-method-sms).

| Field | Availability | Description |
| --- | --- | --- |
| Sender IDs | Optional | Dedicated SMS senders for the OTP traffic of the application. Search for and select senders from the verified senders of your account. A sender is verified per destination country, so each sender is used only for the countries where it is approved. Messages to other countries are sent through DIDWW's shared senders. Countries that are still under review are listed as pending and become available when approved. If your account has no verified senders, the section shows **Get a Sender ID verified**, which opens Sender ID verification. See [Sender ID Verifications](../sms/sender-id-verifications/index.html#sender-id-verifications). The default value is **DIDWW shared sender IDs**. |

## Related resources

- [Create an OTP application](getting-started.html#otp-verification-create-application) - Create an
  application and configure the settings described on this page.
- [Manage OTP applications](manage-applications.html#otp-verification-manage-applications) - View, edit, or
  delete an application, or regenerate its secret.
- [Authentication](authentication.html#otp-verification-authentication) - Choose the authentication mode
  for your integration.
- [Callbacks](callbacks.html#otp-verification-callbacks) - Approve or deny verification requests from
  your backend.
- [Sender ID Verifications](../sms/sender-id-verifications/index.html#sender-id-verifications) - Verify a sender ID to use as a
  dedicated OTP sender.

On this page