Send WhatsApp OTP in Go

package otp

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
)

// apiKey comes from https://app.otpspace.com/dashboard/api-keys.
// Keep it server-side — never ship it in a mobile or browser client.
const apiKey = "sk_live_xxx"

const baseURL = "https://api.otpspace.com/v1"

// SendOTP sends a WhatsApp OTP to an Indonesian number (E.164, e.g.
// "+6281234567890"). OTP Space replies 202 Accepted once it is queued.
func SendOTP(phone string) error {
	payload, _ := json.Marshal(map[string]string{"phone": phone})

	req, _ := http.NewRequest(http.MethodPost, baseURL+"/send", bytes.NewReader(payload))
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return err
	}
	defer res.Body.Close()

	if res.StatusCode != http.StatusAccepted { // 202
		return fmt.Errorf("otp send failed: %s", res.Status)
	}
	return nil
}

// VerifyOTP checks the code the user typed against the OTP that was sent to
// their number. A 200 OK means the code is correct; anything else (422 wrong
// code, 410 expired, 429 too many attempts) means it is not.
func VerifyOTP(phone, code string) (bool, error) {
	payload, _ := json.Marshal(map[string]string{"phone": phone, "code": code})

	req, _ := http.NewRequest(http.MethodPost, baseURL+"/verify", bytes.NewReader(payload))
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return false, err
	}
	defer res.Body.Close()

	return res.StatusCode == http.StatusOK, nil // 200 = verified
}

{
  "success": true,
  "data": {
    "otp_id": "otp_abc123def456",
    "destination": "6281234***90",
    "channel": "whatsapp",
    "status": "queued",
    "expires_at": "2026-07-17T10:05:00Z"
  },
  "credits_remaining": 994
}