> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zupy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify OTP and return customer session

> Verify OTP code and return session token with customer data. Creates customer if new. Session token valid for 30 minutes. Authentication via X-API-Key header (partner API key).



## OpenAPI

````yaml /api-reference/openapi.json post /api/v2/auth/verify-otp/
openapi: 3.0.3
info:
  title: Zupy API v2
  version: 2.0.0
  description: >-
    Zupy API v2 — versioned, gateway-aware API with envelope responses, RFC 7807
    errors, and multi-auth support (JWT, API Key, Device Key).
servers:
  - url: https://api.zupy.com
    description: Production
security: []
tags:
  - name: Authentication
    description: OTP request and verification endpoints
  - name: Customers
    description: Customer management, points, history, and data operations
  - name: Loyalty Programs
    description: Loyalty program configuration and details
  - name: Rewards
    description: Loyalty reward catalog (definitions redeemed with points)
  - name: Companies
    description: Company information and loyalty configuration
  - name: Coupons
    description: >-
      Issued coupons (RewardRedemption) — both loyalty-reward redemptions and
      marketing claims
  - name: Wallet
    description: Apple Wallet pass generation and notifications
  - name: Webhooks
    description: Partner integration webhook endpoints
  - name: Webhook Management
    description: Configure and test outbound webhook delivery
paths:
  /api/v2/auth/verify-otp/:
    post:
      tags:
        - Authentication
      summary: Verify OTP and return customer session
      description: >-
        Verify OTP code and return session token with customer data. Creates
        customer if new. Session token valid for 30 minutes. Authentication via
        X-API-Key header (partner API key).
      operationId: auth_verify_otp
      parameters:
        - in: header
          name: X-API-Key
          schema:
            type: string
          description: Partner API key
          required: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OTPVerifyRequestBody'
            examples:
              OTPVerify—Phone:
                value:
                  identifier: '+5511987654321'
                  otp_code: '123456'
                summary: OTP Verify — Phone
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OTPVerifyRequestBody'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/OTPVerifyRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OTPVerifyResponse'
              examples:
                OTPVerified—ExistingCustomer:
                  value:
                    customer_id: 2awTHloSJX7kGGprFerOOsvABcd
                    is_new: false
                    otp_session: abc123def456...
                    full_name: João Silva
                    points_balance: 150
                    tier: silver
                  summary: OTP Verified — Existing Customer
          description: ''
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
      security:
        - apiKeyAuth: []
components:
  schemas:
    OTPVerifyRequestBody:
      type: object
      properties:
        identifier:
          type: string
          description: Phone (+5511...), email, or CPF
        otp_code:
          type: string
          description: 6-digit OTP code
      required:
        - identifier
        - otp_code
    OTPVerifyResponse:
      type: object
      properties:
        customer_id:
          type: string
          description: Customer ID (KSUID or user PK)
        is_new:
          type: boolean
          description: True if customer was just created
        otp_session:
          type: string
          description: Session token (30min TTL) for subsequent OTP-protected requests
        full_name:
          type: string
          description: Customer full name
        points_balance:
          type: integer
          description: Current points balance
        tier:
          type: string
          nullable: true
          description: Loyalty tier
      required:
        - customer_id
        - full_name
        - is_new
        - otp_session
        - points_balance
        - tier
    Error:
      type: object
      description: RFC 7807 Problem Details error response.
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
      required:
        - detail
        - instance
        - status
        - title
        - type
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: >-
        Per-company partner API key (zupy_pk_…). Validated by Zupy against the
        company integration key hash (Story 14.x); send it on every request as
        the X-API-Key header. Scoped read-write to the owning company's data.

````