Authentication
Every request requires a bearer API key. Create one from your dashboard and send it in the Authorization header.
Every request requires a bearer API key. Create one from your dashboard and store it securely — the raw value is shown only once, at creation time.
API keys are prefixed by environment: otp_live_… for production traffic and
otp_test_… for sandbox testing.
Passing the key
Send the key in the Authorization header on every request:
Authorization: Bearer otp_live_<your_key>Example
curl https://api.otp.black/v1/balance \
-H "Authorization: Bearer $API_KEY"Rate limits
Each key has independent limits, configured when you create it:
- Rate limit — requests per minute.
- Concurrency — maximum in-flight activation operations.
- Active activations — cap on simultaneously open numbers.
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and
X-RateLimit-Reset. Exceeding a limit returns 429.
Missing or invalid keys
A request with no key, or a revoked/expired one, returns 401 with a JSON error
body. See Errors.