Resending, cancelling and replacing a verification code: what happens to the old one

WhatsApp & APIs·· 9 views· 3 min read

The short answer: to send the customer another code, use POST /v1/sms/otp/{id}/resend: a new code goes out under the same id and the validity starts again. To make a code stop working, use POST /v1/sms/otp/{id}/cancel. And remember that a new code for the same number, requested with POST /v1/sms/otp, always cancels the previous one.

Resend, cancel or request another

Operation What it does When to use it
/resend Sends a new code under the same id; validity restarts; attempts already used stay used The customer says it did not arrive, or the code expired
/cancel A pending code stops working; the SMS already sent is not refunded The customer gave up, changed number or the transaction was called off
POST /v1/sms/otp Creates a new code, with a new id and fresh attempts; the previous one for that number becomes cancelled The code failed on attempts, or you want different rules (length, validity)

What happens to the old code

Only the hash of the old code was ever kept, so there is no way to “send it again”. Each resend creates different digits, and the previous code stops working. If the customer gets two SMS in a row (say, one that was delayed and the resent one), only the latest works. Say so on screen: “Use the code from the latest SMS.”

The “Resend code” button on your screen

1 Do not show it straight away. Give the first SMS time to arrive before allowing another. If you set a wait between resends in your account rules, the API enforces it.
2 Show it as a countdown: “You can request another code in 45 seconds.” The customer knows there is no point pressing again.
3 Call /resend only for pending or expired codes. With a verified, failed or cancelled code, the API refuses: request a new code.
4 Update the countdown with the expires_at the resend response returns, and the attempts with attempts_left.
By default there is no limit on resends. Each resend is a new SMS and uses credits. Without a wait, an impatient customer or a bot can press “Resend” dozens of times. Set the wait and the maximum per number per hour: see limits against abuse.
With a Sandbox key, the resend response includes the code too, just like the send response. You can test the “didn't get it, resend, check” flow without using credits.

Want to resend and cancel codes without losing control? See Verification SMS.

See Verification SMS

SEE ALSO

Verification code statuses: pending, verified, expired, failed and cancelled

Limits against abuse: codes per number per hour and the wait between resends

The code entry screen: the field, a countdown, attempts left and clear messages

The SMS verification code did not arrive: what to check, on your side and the customer's

Code length, validity and attempts: choosing length, expires_in and max_attempts

SMS verification API: we generate, send and check the code, and your system keeps only the id

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $5.36/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.