LessOTP Use Case for Passwordless Login
Implement passwordless, typeless login through inbound WhatsApp or Telegram messages and signed LessOTP webhooks.
The Problem with Password and OTP Login
Passwords create memorization, reset, and credential-stuffing burdens. SMS OTP reduces password dependence but still forces users to wait for, copy, and type a code that may arrive late or expire.
Typeless Login with LessOTP
LessOTP moves phone-ownership proof to an inbound message. After a user chooses WhatsApp or Telegram, their chat app opens with a prefilled unique command. They only tap Send; your backend receives a signed verification.success webhook.
Login Integration Flow
- 1.Create an authentication request with the account phone number for Strict Mode.
- 2.Redirect the user to the wa_link or telegram_link returned by the API.
- 3.Match the webhook request_id to the stored login attempt.
- 4.Verify the HMAC signature and Idempotency-Key before creating a session.
- 5.Create the session only after verification.success arrives before expiry.
Security Controls You Still Need
Inbound authentication proves control of the messaging account and associated phone number; it does not replace your full session policy. Use short expiry, rate limits, browser-bound requests, constant-time signature checks, idempotency, and new-login notifications. Provide a separate recovery path for users who lose access to their number.
When to Use Strict and Frictionless Modes
| Existing user | Strict Mode | Send the stored number so the inbound sender must match the account identity. |
|---|---|---|
| Login plus account discovery | Frictionless Mode | Use the verified result to find the account without asking for a phone number first. |
| Integration testing | Staging | Run the real engine and webhook without real messages or credit deductions. |
Strict-Mode Login Request
curl -X POST https://lessotp.com/api/v1/auth/request \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"channel":"whatsapp","phone_number":"6281234567890"}'Test Passwordless Login Before Production
Validate requests, webhook signatures, idempotency, and session creation through a staging App without spending credit.
Open Staging Simulator