Why Ora Repot
One bearer token
Issue keys in OTP Settings, pass Authorization: Bearer orp_live_… — no OAuth, no PKCE.
Template-first OTP
Only AUTHENTICATION templates with status ACTIVE. Placeholder {{1}} is the code.
Wallet reserve / capture
Rp 600 per number. orarepot-otp reserves, then captures or releases after send.
Stable webhooks
otp.sent and otp.failed, HMAC-SHA256, retries from the developer service.
Send an OTP in five lines
const res = await fetch('https://api.orarepot.com/v1/otp/send', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.ORAREPOT_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
to: '+628123456789',
template: 'otp_login',
}),
})
const json = await res.json()The recipient sees the WhatsApp OTP in a couple of seconds.
What’s inside
Public host
api.orarepot.com — never orarepot.com/api. Dashboard stays on orarepot.com.
OpenAPI later
Same contract as OTP Settings: send, logs, webhook deliveries, request log.
Request log
Every authenticated call is listed in OTP Settings → Log request.
Keys & webhooks
Create, revoke, rotate secret — all from the merchant dashboard.