Kirim OTP WhatsApp di Node.js

// Node.js 18+ ships a global fetch — no dependencies needed.
// The key comes from https://app.otpspace.com/dashboard/api-keys.
// Keep it on the server; never expose it in a browser or mobile client.
const API_KEY = process.env.OTPSPACE_API_KEY;
const BASE = "https://api.otpspace.com/v1";

// Send a WhatsApp OTP to an Indonesian number in E.164 form,
// e.g. "+6281234567890". Resolves once OTP Space returns 202 Accepted.
export async function sendOtp(phone) {
  const res = await fetch(BASE + "/send", {
    method: "POST",
    headers: {
      "Authorization": "Bearer " + API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ phone: phone }),
  });

  if (res.status !== 202) {
    const err = await res.json().catch(() => ({}));
    throw new Error(err.error || ("otp send failed: " + res.status));
  }
  return res.json(); // { success, data: { otp_id, ... }, credits_remaining }
}

// Verify the code the user typed. A 200 status means the code is correct;
// 422 (wrong code), 410 (expired) and 429 (too many attempts) mean it is not.
export async function verifyOtp(phone, code) {
  const res = await fetch(BASE + "/verify", {
    method: "POST",
    headers: {
      "Authorization": "Bearer " + API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ phone: phone, code: code }),
  });

  return res.status === 200; // 200 = verified
}

{
  "success": true,
  "data": {
    "otp_id": "otp_abc123def456",
    "destination": "6281234***90",
    "channel": "whatsapp",
    "status": "queued",
    "expires_at": "2026-07-17T10:05:00Z"
  },
  "credits_remaining": 994
}