Free OTP for your SaaS:
login codes by WhatsApp, SMS or email, no per-code fee

// app/api/otp/send/route.ts
import { createHash, randomInt } from 'node:crypto';
import { db } from '@/lib/db'; // your own storage

export async function POST(req: Request) {
  const { phone } = await req.json();
  const code = String(randomInt(0, 1_000_000)).padStart(6, '0');

  await db.otp.save(phone, {
    hash: createHash('sha256').update(code).digest('hex'),
    expiresAt: Date.now() + 5 * 60_000,
    attempts: 0,
  });

  await fetch('https://api.unlimitedmessaging.app/message', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.UM_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      to: { phone },
      channels: [{ channel: 'WHATSAPP' }],
      text: `${code} is your Acme verification code. It expires in 5 minutes.`,
    }),
  });

  return Response.json({ sent: true });
}

// app/api/otp/verify/route.ts
import { createHash, timingSafeEqual } from 'node:crypto';
import { db } from '@/lib/db';

export async function POST(req: Request) {
  const { phone, code } = await req.json();
  const row = await db.otp.get(phone);

  if (!row || row.expiresAt < Date.now() || row.attempts >= 5) {
    return Response.json({ ok: false }, { status: 400 });
  }

  const hash = createHash('sha256').update(String(code)).digest('hex');
  if (!timingSafeEqual(Buffer.from(hash), Buffer.from(row.hash))) {
    await db.otp.incrementAttempts(phone);
    return Response.json({ ok: false }, { status: 401 });
  }

  await db.otp.delete(phone);
  return Response.json({ ok: true });
}