Email OTP

Send and verify six-digit one-time passwords by email through the v2 API.

Before you start

Get an API key with email access enabled.
Set the base URL to https://sms.chinqit.com/api/v2.
Send X-API-Key or Authorization: Bearer with every request.

Send an email OTP

Call POST /api/v2/code with channel: "email" and the recipient's email.

curl -X POST https://sms.chinqit.com/api/v2/code \
  -H 'X-API-Key: your-api-key' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "user@example.com",
    "channel": "email",
    "language": "en"
  }'

A successful response includes the message ID, the ten-minute expiry, and the email price used for the send:

{
  "success": true,
  "messageId": "550e8400-e29b-41d4-a716-446655440000",
  "expiresIn": 600,
  "cost": 0.23,
  "pricePerMessage": 0.23
}

Email OTP responses do not include SMS fields such as parts, encoding, or length.

Verify the code

Call POST /api/v2/check with the same normalized email address, the six-digit code, and channel: "email".

curl -X POST https://sms.chinqit.com/api/v2/check \
  -H 'X-API-Key: your-api-key' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "user@example.com",
    "otp": "123456",
    "channel": "email"
  }'

{
  "success": true,
  "message": "OTP verified successfully",
  "verified": true
}

The code expires after ten minutes and works once. A wrong code returns 400 and leaves the remaining-attempt count in the response. The API allows three failed attempts before it invalidates the code.

Sender and email template

ChinqIT sends email OTPs from the shared sender ChinqIT Verify <otp@chinqit.com>. The email shows your API key client's configured name when one exists.

The language field accepts fr, en, or ar and defaults to fr. ChinqIT renders the subject, body, expiry notice, and security footer in that locale. Arabic email uses right-to-left layout. Each email tells the recipient that the code expires in ten minutes and should not be shared.

Pricing

Email OTP uses per-type-global pricing. An administrator configures one global email price, which applies to every send. Sending is disabled until that price exists: without an active email pricing row, sends fail with 503 EMAIL_PRICING_NOT_CONFIGURED.

The response returns the amount as cost and pricePerMessage. Verification creates no additional charge. A send that fails is not charged.

Verification webhook

Subscribe to otp.verified to receive a notification after a successful verification. Email events include email in data instead of phoneNumber:

{
  "id": "evt_01j9z...",
  "type": "otp.verified",
  "createdAt": "2026-06-27T10:02:00.000Z",
  "data": {
    "messageId": "550e8400-e29b-41d4-a716-446655440000",
    "email": "user@example.com",
    "verifiedAt": "2026-06-27T10:02:00.000Z"
  }
}

See Webhooks for subscription and signature verification details.

Errors

Status	When it occurs	What to do
`400`	The email, channel, or code fails validation; the code is wrong; or the recipient exceeded verification attempts.	Send a valid email and six-digit code. Request a new code after three failed attempts.
`401`	The request has no valid API key.	Send `X-API-Key` or a bearer token.
`402`	The billing account has insufficient balance.	Add balance, then retry the send.
`403`	The API key is invalid, inactive, unassigned, or lacks email access.	Turn on the key's Email switch under API keys in the dashboard.
`404`	The code does not exist or has expired.	Send a new email OTP.
`429`	The recipient or API key hit a rate limit, or the key reached its monthly usage limit.	Wait for the limit to clear, or contact ChinqIT support to raise the key's monthly limit.
`502`	The email could not be sent (`errorCode`: `EMAIL_SEND_FAILED`). You are not charged.	Retry later. If it keeps happening, contact support with the `messageId`.
`503`	The email service lacks its required configuration.	Contact ChinqIT Verify support.

For endpoint schemas and all response fields, see the API Reference.