No feature gates on security. Plans differ only by volume.
Email, SMS or both from one request, sharing a single request ID.
Any SMTP host: your cPanel mailbox, a transactional provider, or a relay.
Configure any provider REST endpoint, or add a provider class for full control.
Per-channel sent/failed status recorded against every OTP request.
Codes come from random_int(), never from time or sequence based sources.
Peppered SHA-256 digests; a database dump cannot reveal a live code.
Successful verification rotates the stored hash so a code cannot be replayed.
Configurable maximum attempts per code plus an IP guard on the verify endpoint.
Daily and monthly quotas per account, overridable per customer by the administrator.
Per IP, per API key, per destination cooldown - all stored in MySQL.
Generate, mask, copy once, disable, revoke or regenerate at any time.
Suspend, activate, reset password or adjust limits from the admin panel.
Endpoint, method, status code, latency, IP and request ID for every call.
Channel, masked destination, purpose, status, created/expiry/verified timestamps.
Fourteen-day request trend and verification success ratio on the dashboard.
Send and verify real codes from the dashboard and read the raw JSON response.