LessOTP Use Case for Critical Action Verification
Protect withdrawals, password and phone changes, and account deletion with LessOTP Strict Mode step-up authentication.
Critical Actions Need Fresh Identity Proof
A valid login session may not be enough to authorize withdrawals, password changes, phone-number updates, new payout destinations, or account deletion. Devices can be left unlocked, session cookies can be stolen, and email accounts can be compromised. Step-up authentication asks for fresh proof immediately before a high-risk change is processed.
Actions Well Suited to LessOTP Protection
Withdrawal or payout
Verify before creating the final payment instruction.
Password or email change
Prevent an attacker from locking the rightful owner out.
Phone-number change
Verify the old number before replacing the primary identity.
New bank account or beneficiary
Confirm account control before enabling a new destination.
Account deletion
Require explicit fresh proof before an irreversible operation.
Use Strict Mode to Bind Verification to the Account
For a critical action, your backend already knows the user's verified phone number. Include that phone_number when creating the LessOTP request. The verification engine succeeds only when the inbound sender matches the stored number and the unique_code remains valid.
A Safe Implementation Sequence
- 1.Authenticate the user session and re-check authorization for the requested resource.
- 2.Store the critical-action intent server-side as pending with a short expiry.
- 3.Create a LessOTP Strict Mode request using the account's verified phone number.
- 4.Present the wa_link or telegram_link; do not execute the action yet.
- 5.Verify the webhook signature, Idempotency-Key, request_id, status, expiry, and intent binding.
- 6.Execute the action exactly once in a transaction, then mark the intent consumed.
Step-Up Auth Does Not Replace Transaction Authorization
LessOTP proves control of a phone number, not that a withdrawal amount or destination is correct. Your backend must still show an action summary, validate balances and limits, apply cooldowns when appropriate, record audit logs, and reject replays. For very high risk, combine it with an independent factor or manual review based on your threat model.
Strict-Mode Request Before a Critical Action
curl -X POST https://lessotp.com/api/v1/auth/request \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"channel":"whatsapp","phone_number":"6281234567890"}'Execute Only After a Verified Webhook
Return a pending response to the UI and complete the operation from an internal handler after the webhook validates. Never trust a browser redirect as proof of success, and never expose your LessOTP API key to the client.
Test Step-Up Authentication End to End
Simulate success, expiry, mismatch, duplicate delivery, and invalid signatures in staging before protecting production actions.
Open API Documentation