Verify the code a customer entered against an otp_id from Send OTP.
Endpoint
Request body
The otp_id returned when the code was sent.
The code the customer entered.
Response
Whether the code matched and hasn’t expired.
Only present when valid is false — attempts left before this otp_id locks.
Not sure which Windows tab to use? The two aren’t interchangeable — pasting one into the wrong shell fails with a ... is not recognized error. Use CMD only in classic Command Prompt. Use PowerShell if your terminal is PowerShell, Windows Terminal, or VS Code’s integrated terminal — the default on most modern Windows setups. The PowerShell example uses Invoke-RestMethod rather than curl.exe to avoid PowerShell’s known issues passing complex quoted JSON to external executables.
Each otp_id allows a limited number of incorrect attempts (default 5). Once exhausted, verification returns the otp_max_attempts error instead of valid: false — send a new code rather than retrying indefinitely. An expired code returns otp_expired. Both are structured errors, not valid: false — see Errors. What happens on success
A successful verification fires an otp.verified webhook event if you’ve registered one — see Webhooks. 
