Email OTP API
Send and verify OTP codes by email with two API calls.
SwayamMail generates the one-time password, emails it to your user and checks it for you. No code to store, no expiry logic to write, no DLT registration.
Free for 1,000 emails a month. About 2 paise per OTP after that.
How to send an OTP by email
1. Send the code
Post the user's email address. We generate a code and deliver it in a plain email with the code in the subject line, so it is readable from the notification.
curl https://api.swayammail.yugaas.in/v1/otp/send \
-H "x-api-key: sk_prod_..." \
-H "content-type: application/json" \
-d '{
"email": "user@example.com",
"ip": "203.0.113.7",
"purpose": "login"
}'
202 {
"id": "8c1e...",
"email": "user@example.com",
"expires_at": "2026-10-30T10:10:00Z"
}2. Verify what the user typed
Post the address and the code. You get a clear yes or no, and a reason when it fails: invalid, expired, already used or too many attempts.
curl https://api.swayammail.yugaas.in/v1/otp/verify \
-H "x-api-key: sk_prod_..." \
-H "content-type: application/json" \
-d '{ "email": "user@example.com", "code": "482913" }'
200 { "valid": true, "id": "8c1e...", "email": "user@example.com" }
200 { "valid": false, "reason": "invalid", "attempts_remaining": 3 }Everything an OTP system needs, already built.
Writing OTP yourself means a codes table, hashing, expiry jobs, attempt counters and abuse limits. All of that is handled here.
Code generation
We create a random code for every request. Asking for a new code cancels the previous one.
Safe storage
Codes are stored only as hashes, so even we cannot read them back.
Expiry and single use
Codes expire after 10 minutes and work once. Both are adjustable in OTP settings.
Wrong-attempt lockout
A code locks after 5 wrong tries, which stops guessing attacks.
Rate limits
One code per address per minute and 5 per hour, plus 20 per IP per hour when you pass the user's IP.
CAPTCHA
Protect public forms with Cloudflare Turnstile or hCaptcha. We check the token before sending.
A fast lane
OTP mail travels on its own queue, so codes never wait behind a marketing campaign.
Bounce protection
If too many of your codes bounce, sending pauses before your domain reputation is hurt.
Email OTP in Node.js
The API is plain HTTPS and JSON, so it works from any language. Here is the whole integration in Node.js: one function to send, one to verify.
What you can build
Passwordless login
Let users sign in with a code instead of remembering a password.
Signup email verification
Confirm that a new user owns the address they typed.
Two-step verification
Add a second check before sensitive actions such as payouts or password changes.
Fallback for SMS OTP
Offer email when an SMS code does not arrive, without a second vendor.
const API = "https://api.swayammail.yugaas.in/v1/otp";
const headers = {
"x-api-key": process.env.SWAYAMMAIL_API_KEY,
"content-type": "application/json",
};
// When the user asks for a code
export async function sendOtp(email, ip) {
const res = await fetch(API + "/send", {
method: "POST",
headers,
body: JSON.stringify({ email, ip }),
});
return res.ok;
}
// When the user submits the code
export async function verifyOtp(email, code) {
const res = await fetch(API + "/verify", {
method: "POST",
headers,
body: JSON.stringify({ email, code }),
});
const { valid } = await res.json();
return valid === true;
}Email OTP pricing
OTP emails count toward your monthly plan with no extra fee: free for 1,000 emails a month, then ₹499 plus GST for 25,000. The same account also sends your transactional and marketing email.
Email OTP questions
How do I send an OTP by email?
Create a SwayamMail account, verify your sending domain and create an API key. Then POST the user's email address to /v1/otp/send. SwayamMail generates a one-time code and emails it. When the user types the code, POST it to /v1/otp/verify and you get back valid true or false.
Do I need to generate or store OTP codes myself?
No. SwayamMail generates the code, stores only a hash of it, tracks expiry and wrong attempts, and tells you whether the code a user typed is valid. Your database never holds an OTP.
How long is an email OTP valid?
By default a code is valid for 10 minutes, works once, and locks after 5 wrong attempts. You can change these in OTP settings.
How much does it cost to send OTP by email?
The free plan includes 1,000 emails a month. The Starter plan is ₹499 a month plus GST for 25,000 emails, which is about 2 paise per OTP. OTP emails count toward your normal monthly plan; there is no separate OTP fee.
Is email OTP cheaper than SMS OTP in India?
Usually, yes. SMS OTP in India is charged per message and needs DLT registration of your sender ID and templates. Email OTP needs neither: you verify your domain once and pay a flat monthly plan.
How do I stop bots from abusing my OTP form?
SwayamMail applies per-address and per-IP rate limits automatically, and can require a Cloudflare Turnstile or hCaptcha token before it sends a code. Turn CAPTCHA on in OTP settings and pass the token with each send request.
Can I test OTP without sending real emails?
Yes. Use a sandbox API key. Nothing is sent, and the response includes the code so you can test the full send and verify flow in development or CI.
Which address do OTP emails come from?
From an address on your own verified domain, set in OTP settings. Many teams use a subdomain such as otp.yourbrand.com so login codes are kept apart from marketing mail.
Add email OTP to your app today.
Create a free account, get a sandbox key and test the full flow before you send a single real email.