OTP API

<?php
// Put this helper at the top of your backend integration file.
function meraotp(string $method, string $path, ?array $payload = null, array $extraHeaders = []): array
{
    $key = getenv('MERAOTP_API_KEY');
    if (!$key) throw new RuntimeException('Set MERAOTP_API_KEY on your server first.');
    $ch = curl_init('https://meraotp.in/api/v1' . $path);
    $headers = array_merge([
        'Authorization: Bearer ' . $key,
        'Accept: application/json',
        'Content-Type: application/json',
    ], $extraHeaders);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 5,
        CURLOPT_TIMEOUT => 20,
    ]);
    if ($payload !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload, JSON_THROW_ON_ERROR));
    $raw = curl_exec($ch);
    $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $error = curl_error($ch);
    curl_close($ch);
    if ($raw === false) throw new RuntimeException('Connection failed: ' . $error);
    // Keep error JSON too: a message_id may be returned with an uncertain send.
    return ['http_status' => $status, 'json' => json_decode($raw, true, 512, JSON_THROW_ON_ERROR)];
}

// Save as an .mjs backend file using Node.js with built-in fetch.
async function meraotp(method, path, payload, extraHeaders = {}) {
  const key = process.env.MERAOTP_API_KEY;
  if (!key) throw new Error('Set MERAOTP_API_KEY on your server first.');
  const response = await fetch('https://meraotp.in/api/v1' + path, {
    method,
    headers: {
      'Authorization': `Bearer ${key}`,
      'Accept': 'application/json',
      'Content-Type': 'application/json',
      ...extraHeaders
    },
    body: payload === undefined ? undefined : JSON.stringify(payload),
    signal: AbortSignal.timeout(20000),
    redirect: 'error'
  });
  // HTTP errors do not throw in fetch. Preserve both status and error JSON.
  return { httpStatus: response.status, json: await response.json() };
}

// Add this after the meraotp() helper above.
// Generate ONCE per login/signup attempt; save it before sending.
$attemptKey = 'login_' . bin2hex(random_bytes(12));
$reply = meraotp('POST', '/otp/send', [
    'mobile' => '9876543210', // Replace with the consenting user's number.
    'purpose' => 'login',
    'otp_length' => 6,
    'reference' => 'login_attempt_1001',
], ['Idempotency-Key: ' . $attemptKey]);
$result = $reply['json'];
$messageId = $result['data']['message_id'] ?? null;
// Save messageId against THIS user/session and inspect http_status + status.
// A network retry must reuse attemptKey and the same payload.

import { randomUUID } from 'node:crypto';
// Add this after the meraotp() helper. Persist the key per attempt.
const attemptKey = 'login_' + randomUUID();
const reply = await meraotp('POST', '/otp/send', {
  mobile: '9876543210', // Replace with the consenting user's number.
  purpose: 'login',
  otp_length: 6,
  reference: 'login_attempt_1001'
}, { 'Idempotency-Key': attemptKey });
const result = reply.json;
const messageId = result.data?.message_id;
// Save messageId against this user/session. Inspect reply.httpStatus + status.
// Reuse attemptKey AND the payload if this same attempt needs a network retry.

// Load message_id from YOUR server-side login attempt, not another user's input.
$reply = meraotp('POST', '/otp/verify', [
    'message_id' => '8f21c6f06f7d4a88a1c6b6ca8c8d3a20',
    'otp' => '123456', // The code entered by this user; keep it as a string.
]);
$result = $reply['json'];
$verified = $reply['http_status'] === 200
    && ($result['success'] ?? false) === true
    && ($result['data']['verified'] ?? false) === true;
// Grant access only if verified AND the challenge belongs to this session.
// Mark your own login attempt consumed so it cannot unlock a second action.

const reply = await meraotp('POST', '/otp/verify', {
  message_id: '8f21c6f06f7d4a88a1c6b6ca8c8d3a20', // From your server session.
  otp: '123456' // The string entered by this user.
});
const verified = reply.httpStatus === 200
  && reply.json.success === true
  && reply.json.data?.verified === true;
// Grant access only if verified and the challenge belongs to this session.
// Consume your own login attempt once; do not treat a repeated check as a new login.

$messageId = '8f21c6f06f7d4a88a1c6b6ca8c8d3a20';
$reply = meraotp('GET', '/otp/status/' . rawurlencode($messageId));
$result = $reply['json'];
$status = $result['data']['status'] ?? null;
// Read this status only when http_status is 200 and success is true.

const messageId = '8f21c6f06f7d4a88a1c6b6ca8c8d3a20';
const reply = await meraotp('GET', '/otp/status/' + encodeURIComponent(messageId));
const status = reply.json.data?.status;
// Read this status only when httpStatus is 200 and success is true.