An OTP (one-time password) is a short code, usually six digits, that works once and expires quickly. It proves the person in front of your app controls a phone number or inbox right now.
What it is used for
- Confirming a new account belongs to a real, reachable person
- Adding a second check to login
- Approving risky actions such as payments or withdrawals
- Recovering access when a password is lost
Why it works
A password can be reused, leaked or guessed. A code sent to a device is only useful for minutes and only once, so a stolen copy has little value later. That is the whole idea: shrink the time and scope in which a leaked secret can hurt you.
The code is not a full identity check. It shows possession of a channel, nothing more, so pair it with other signals when the stakes are high. Tambua offers send and verify endpoints that cover this basic flow.
Need OTPs that reach users across Africa? Read the API docs or get a free test key.