...
| Code Block | ||||
|---|---|---|---|---|
| ||||
Api details:
URI : v1/otp/generate
Method: POST
header: api key
request body:
{
"request":
{
"key":"email/phone value",
"type" : "supported type as of now{email or phone}"
}
}
Response:
Success or failure . (in case of success , user will get OTP either on email or phone) - Response structure will be same as sunbird other api's.
Case 1 : 200
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "",
"status": "success",
"errmsg": ""
},
"responseCode": "OK",
"result": {
"response":"SUCCESS"
}
}
Case 2 : 400
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "MAX_LIMIT_EXHAUSTED",
"status": "MAX_LIMIT_EXHAUSTED",
"errmsg": "Only 4 OTP can be generated with in 24 hours"
},
"responseCode": "CLIENT_ERROR",
"result": {
}
}
// 400 error code can have : Phone or email is already in used , INVALID_PHONE/EMAIL , PHONE/EMAIL IS BLOCKED.
Case 3 : 500
{
"id": "api.otp.generate",
"ver": "v1",
"ts": "2018-11-28 11:12:31:853+0000",
"params": {
"resmsgid": null,
"msgid": "8e27cbf5-e299-43b0-bca7-8347f7e5abcf",
"err": "SERVER_ERROR",
"status": "SERVER_ERROR",
"errmsg": "Process failed, please try again."
},
"responseCode": "SERVER_ERROR",
"result": {
}
}
|
-- This api will have following validations:
...
3. If requested phone/email is already in otp _ authenticate table and is not expired yet and attempt threshold is less than set value then send same OTP....
https://docs.msg91.com/collection/msg91-api-integration/5/send-otp-message/TZ6HN0YI
| Pros | Cons |
|---|---|
|
|
|
Table structure to store OTP:
...
| Key | data type | purpose |
|---|---|---|
| id | text (primary key) | |
| type | text | possible values are email or phone. Based on type we can identify key having value as email or phone |
| key | text (encrypted in DB) | source against which OTP is generated (key will have value as either email or phone) |
| OTP | text | generated OTP |
| createdOn | timestamp | at which time it was generated |
| lastUsedOnupdatedOn | timestamp | when it was last used |
| retryCount | int | how many time user already retried it |
| isLocked | boolean | if retry count exceed limit then isLocked true |
Table structure to store invalid/blocked phone number
Structure : 1
| key | data type | purpose |
|---|---|---|
| phone | text | phone number which is marked as invalid or blocked by sms gateway. |
| createdOn | timestamp | when row inserted |
| blockedOn | timestamp | when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it. |
Structure 2:
| key | data type | purpose |
|---|---|---|
| key | text | can be invalid/blocked phone number or email |
| type | text | As of now it can be email or phone |
| createdOn | timestamp | when row inserted |
| blockedOn | timestamp | when this user was blocked, if any phone number is blocked due to max hit or some other reason then we can move that row in this table and from OTP table will delete it. |
Open questions:
- Process to clear expired OTP or blocked OTP (when exactly we need to clear it.)
...
- Sending SMS or Email are Async call , if format is valid it will return success , but later it will try to send it that might got failure.
- As SMS gate way will have api to check delivery reports : https://docs.msg91.com/collection/msg91-api-integration/5/delivery-report/T19VM23R
- Msg91 provides webhooks to get delivery reports , so instead of we making call to get reports , we can use webhook: https://help.msg91.com/article/56-how-can-i-get-the-delivery-reports-on-my-url-through-api-what-is-the-reason-for-not-getting-report-on-my-url
- possibility to attach a scheduler to get the status based on messageId and update the status in DB
- In case of email how can we confirm delivery reports?
- What will happen if delivery reports indicates failure ? (cases like blocked or invalid numbers)
- What should be frequency to get OTP delivery reports?
...