One-Time Password
Authenticate users and transactions with OTP and 2FA.
Accessing accounts and performing transactions requires strong user authentication. In the context of customers, it is strong customer authentication (SCA) that is required and often mandated. One-Time Passwords (OTP), along with Two-Factor Authentication (2FA), provide a means to verify that a person is who they claim to be.
Ways to use One-Time Password
The Melrose Labs One-Time Password service provides the means to process One-Time Passwords using one of two ways. OTPs are generated by the service, sent to users and verified by the service; or are generated by an application on the user's device (e.g. Google Authenticator) and verified by the service.
Sending OTPs to Users
Sending One-Time Passwords to users can be done with a REST call to our OTP API, and delivered via SMS text message, voice call or email.
When using the Melrose Labs One-Time Password service, we don't let you know the actual One-Time Password that has been sent to your user, therefore preventing potential leakage of this critical information at the source.
TOTP Service: OTP and Google Authenticator
Time-base One-Time Passwords: Users can quickly be enrolled with the One-Time Password service and use the Google Authenticator mobile app on their mobile to generate OTPs. The user provides the OTP that was generated on their mobile and the service then verifies this.
Use of this method may be preferable in some scenarios.
Integrate with the One-Time Password service
Integrate OTP into your application using our OTP API. For simple integration, use one OTP API call to send an OTP to a user and another API call to verify what the user provided.
Sending OTP codes and verifying code from user
To send an OTP, you specify the message content and the recipient. You can also specify the complexity of the OTP (e.g. length, digits-only, letters-only or letters and digits) and its expiry. Delivery of the OTP will take place in a few seconds when using SMS text, email or voice call.
SIM-Swap Detection: For OTP delivery to UK mobiles via SMS or voice call, a check can be performed to confirm that the user account is not the victim of SIM-swapping.
TOTP Service: Verify code from user when using Google Authenticator
Enroll user with service: Make REST API call to add user to service. Provide user with enrolment link for them to scan QR code with Google Authenticator.
When user then performs login or transaction, ask them for TOTP code from Google Authenticator. Make a REST API call to the OTP service and provide the TOTP code from the user and the user's OTP service user ID. The service will then verify if the provided code is valid for that user at that time.
REST API
The Melrose Labs One-Time Password service is available using our REST Identity API.