The verification layer is a defense layer.
OTP infrastructure is the most attacked surface you own. Code storage, rate limits, idempotency and fraud signals are on by default in KolayOTP — nothing to configure.
Codes are never stored in plaintext
Generated codes are kept only as HMAC-SHA256 digests under a per-tenant secret. Verification uses constant-time comparison and the record is deleted at TTL.
hmac(code, tenant_secret)
Redis fails closed
Rate-limit counters live in Redis. If Redis is unreachable the system rejects verification and writes the event to the fraud log — it never silently opens.
503 rate_limiter_unavailable
Idempotency
The idempotency-key header is retained for 24 hours. Retries with the same key never produce a second message; the original response is replayed.
idempotency-key: <uuid>
Attempts and TTL
Five attempts and a 10-minute lifetime by default. Wrong attempts back off exponentially and the session closes once the limit is hit.
attempts_left: 5 · ttl: 600s
Fraud events
Anomaly signals are derived per recipient, IP, tenant and device fingerprint, and stream to your webhook in real time.
event: otp.fraud_suspected
Multi-tenant isolation
Every tenant runs with its own schema space, key set and quota. On key leakage, revoke and rotate with a single call.
POST /keys/{id}/revoke
Default limits
| Rule | Limit | Window |
|---|---|---|
| Sends per recipient | 3 | 10 minutes |
| Verify attempts per recipient | 5 | per session |
| Sends per IP | 30 | 1 hour |
| Requests per tenant | 600 | 1 minute |
| Resend cooldown | 60s | per session |
Data and compliance
Data locationBasefyio Postgres · EU region
RetentionDelivery logs 90 days, codes at TTL
EncryptionTLS 1.3 in transit, AES-256 at rest
AccessRole-based, audit trail in the panel
KVKK / GDPRDPA and notices downloadable in the panel
BackupsDaily snapshots, 30-day restore window
Report a vulnerability: security@kolayotp.com — we respond within 72 hours.
Send your first OTP in five minutes.
No credit card. Start on a sandbox key and switch to live when you're ready.