Verify OTP

POST /v1/users/auth/otp/verify

Auth: None

Field	Type	Required	Description
channel	string	Yes	"email" or "phone" — must match the request
identifier	string	Yes	Same identifier used in the request
code	string	Yes	The code received

curl -X POST https://api.2settle.io/v1/users/auth/otp/verify \
  -H "Content-Type: application/json" \
  -d '{ "channel": "email", "identifier": "jane@example.com", "code": "482913" }'

{
  "success": true,
  "data": {
    "user": {
      "id": "b3f1c2d4-...",
      "displayName": null,
      "avatarUrl": null,
      "status": "active",
      "lastLoginAt": "2026-07-10T09:00:00.000Z",
      "createdAt": "2026-07-01T12:00:00.000Z",
      "updatedAt": "2026-07-10T09:00:00.000Z"
    },
    "accessToken": "eyJhbGciOi...",
    "refreshToken": "6f2c9a8e...",
    "expiresInSec": 900
  }
}

Notes:

• First-time identifiers auto-create a user row — there is no separate signup step.
• Up to OTP_MAX_ATTEMPTS (default 5) wrong codes are allowed per issued code before it locks out.
• A matching, unexpired, unconsumed code is required or the call fails with INVALID_OTP (400) — this one code covers "wrong", "expired", and "already used" uniformly.