Ora Repot
Dashboard

OTP

Webhooks

Ora Repot POSTs to your HTTPS URL. Events: otp.sent and otp.failed. Verify HMAC-SHA256.

Set the URL in Dashboard → OTP Settings. The signing secret is shown when you save or rotate.

Headers

X-OraRepot-Signature: sha256=<hex>
X-OraRepot-Event: otp.sent

Body

{
  "id": "evt_01J…",
  "event": "otp.sent",
  "request_id": "req_01J…",
  "to": "+628123456789",
  "template": "otp_login",
  "created_at": "2026-08-25T03:00:00.000Z"
}