OTP Verification

This add-on verifies that a customer really owns the phone number or email they provide, using a one-time password (OTP) sent by SMS or email. You can require verification at checkout, login, or registration, and let customers sign in by phone.

Plan: Pro (Beta)   Add-on: Verification   Where: StoreEngine → Settings → Verification 

What You Can Do

  • Send a verification code by SMS (Twilio, Vonage, or generic) or by email.
  • Require customers to verify before checkout, login, or registration.
  • Let customers use their phone number as their login identity.
  • Optionally make OTP the only way to sign in (no passwords for customers).
  • Reduce fake orders by requiring verified contact at checkout.

Turn On Verification

  1. Go to StoreEngine → Add-ons.
  2. Toggle on Verification.
  3. Configure at StoreEngine → Settings → Verification.
On Verification Add-On
Note: Email OTP works out of the box. Phone (SMS) OTP needs an SMS gateway configured first.

Configure Verification

Configure Verification On StoreEngine Setting

Identifier Mode

Choose how customers identify themselves:

  • Email only — customers are identified and verified by email address.
  • Phone only — customers are identified and verified by phone number. This option requires an SMS gateway.
  • Phone or email — customers can use either a phone number or an email address.

Default dialing code — the country dialing code applied to phone numbers, entered as digits only (for example, 880).

Verification (Anti-Fake Order)

  • Require OTP verification of the customer contact at checkout — customers must verify their phone or email with a code before they can place an order.
  • Force OTP for every login & registration — customers sign in only with a code; this disables password sign-in for customers. Staff with admin or manager roles can still use passwords.

OTP Behaviour

Setting

Default

What It Does

Verified window (seconds)

900

How long a code remains usable before it expires (300 seconds = 5 minutes).

Code length

6

Number of digits in the verification code.

Code expiry (seconds)

300

How long a code remains usable before it expires (300 seconds = 5 minutes).

Resend cooldown (seconds)

60

Minimum wait before a customer can request a new code.

Max verify attempts

5

Wrong tries allowed before the code is locked.

Max codes per hour

5

Codes a single contact can request per hour.

SMS Channel

Pick the Active SMS gateway and enter its details. The Generic HTTP gateway lets you connect any SMS provider that accepts an HTTP request.

  • Endpoint URL — the provider’s send URL (for example, https://api.example.com/send).
  • HTTP Method — the request method, typically POST.
  • Body Content-Type — the request body format, such as form.
  • Authorization Header (optional) — an auth token if your provider requires one (for example, Bearer xxxx).
  • Body Template — the request payload, for example {"to":"{to}","message":"{message}"}.
  • SMS message template — the text customers receive, for example Your {store_name} verification code is {code}.

Tokens: {code}, {store_name}.

Email Channel

Email OTP requires no extra setup. Customise the message sent to customers:

  • Email subject — the subject line, for example Your {store_name} verification code.
  • Email body (HTML) — the HTML content of the verification email. Insert the code with the {code} token.

Tokens: {code}, {store_name}.

Save Your Changes

Click Save Settings at the top right of the page to apply your configuration.

Troubleshooting

Problem

What to Check

Verification is not required at checkout

In Phone only mode with no SMS gateway, enforcement is disabled. Configure a gateway.

Customer did not get the SMS

Check SMS gateway credentials and balance.

Please wait when requesting a code

Customer is within the resend cooldown — wait the configured seconds.

Code says it is expired

Codes expire after the code expiry time. Request a new one.

Staff are blocked by Force OTP

Staff with admin/manager roles are exempt and can still use passwords.