문자 인증을
서비스에 연결하세요.

curl -X POST "https://smsotp.imtdot.kr/api/v1/sessions" \
  -H "X-API-Key: sms_live_YOUR_KEY" \
  -H "X-API-Secret: sms_secret_YOUR_SECRET" \
  -H "Content-Type: application/json" \
  --data '{
    "callback_url": "https://service.example.com/auth/sms/callback",
    "state": "6a9e09bd-17ea-4aa6-b82a-cb1f9ccd6a2e"
  }'

성공 출력 예시 · HTTP 201

{
  "request_id": "550e8400-e29b-41d4-a716-446655440000",
  "verification_url": "https://smsotp.imtdot.kr/v/5yR3lR4FM0uX6dQKpYxWf8YpM0zFQhX5",
  "expires_in": 600,
  "expires_at": "2026-08-30T01:20:00.000Z",
  "session_reuse_enabled": true
}

const SMS_OTP_BASE = 'https://smsotp.imtdot.kr';

const response = await fetch(`${SMS_OTP_BASE}/api/v1/sessions`, {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'X-API-Key': process.env.SMS_OTP_API_KEY,
    'X-API-Secret': process.env.SMS_OTP_API_SECRET,
  },
  body: JSON.stringify({
    callback_url: 'https://service.example.com/auth/sms/callback',
    state: crypto.randomUUID(),
  }),
});

const data = await response.json();
if (!response.ok) throw new Error(data.error);

// 사용자를 일회용 인증 URL로 이동
res.redirect(data.verification_url);

세션 재사용 시 결과

{
  "verification": {
    "method": "existing_session"
  }
}

Callback 서버 처리 예시

const { code, state } = req.query;

if (!code || !state || state !== req.session.smsOtpState) {
  return res.status(400).send('Invalid callback state');
}

// 여기서 code를 결과 교환 API로 전송

curl -X POST "https://smsotp.imtdot.kr/api/v1/results/exchange" \
  -H "X-API-Key: sms_live_YOUR_KEY" \
  -H "X-API-Secret: sms_secret_YOUR_SECRET" \
  -H "Content-Type: application/json" \
  --data '{"code":"result_A1B2C3D4"}'

const response = await fetch('https://smsotp.imtdot.kr/api/v1/results/exchange', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'X-API-Key': process.env.SMS_OTP_API_KEY,
    'X-API-Secret': process.env.SMS_OTP_API_SECRET,
  },
  body: JSON.stringify({ code }),
});

const result = await response.json();

if (!response.ok || result.verified !== true) {
  throw new Error(result.error || 'SMS verification failed');
}

console.log(result.phone);

import crypto from 'node:crypto';

const SMS_OTP_BASE = 'https://smsotp.imtdot.kr';
const CALLBACK_URL = 'https://service.example.com/auth/sms/callback';

app.get('/verify-phone', async (req, res) => {
  const state = crypto.randomUUID();
  req.session.smsOtpState = state;

  const r = await fetch(`${SMS_OTP_BASE}/api/v1/sessions`, {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'X-API-Key': process.env.SMS_OTP_API_KEY,
      'X-API-Secret': process.env.SMS_OTP_API_SECRET,
    },
    body: JSON.stringify({ callback_url: CALLBACK_URL, state }),
  });

  const data = await r.json();
  if (!r.ok) return res.status(502).json(data);
  return res.redirect(data.verification_url);
});

app.get('/auth/sms/callback', async (req, res) => {
  const { code, state } = req.query;

  if (!code || !state || state !== req.session.smsOtpState) {
    return res.status(400).send('Invalid callback state');
  }

  delete req.session.smsOtpState;

  const r = await fetch(`${SMS_OTP_BASE}/api/v1/results/exchange`, {
    method: 'POST',
    headers: {
      'content-type': 'application/json',
      'X-API-Key': process.env.SMS_OTP_API_KEY,
      'X-API-Secret': process.env.SMS_OTP_API_SECRET,
    },
    body: JSON.stringify({ code }),
  });

  const result = await r.json();
  if (!r.ok || result.verified !== true) {
    return res.status(400).json(result);
  }

  req.session.verifiedPhone = result.phone;
  req.session.phoneVerified = true;
  return res.redirect('/verification-complete');
});