Most apps that need phone verification rebuild the same five things: a form, a send, an expiry, a retry rule and a verify step. It's not interesting code but it's load bearing. Here's what happens when Claude Code has a real OTP API attached while it writes that code. I work at MyOTP.App, the API in question.
One line, once:
claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp
The key comes from myotp.app/sign-up, 15 trial credits, no card. Allowlist your IP on the key, or * while developing.
Add phone verification to my Express app. The user enters a phone number, gets a 6 digit code by SMS, types it in, and on success is marked verified. Use the MyOTP REST API from the server, never from the browser.
// routes/verify.js
const express = require("express");
const router = express.Router();
const pending = new Map(); // phone -> message_id
const API = "https://api.myotp.app";
const headers = {
"Content-Type": "application/json",
"X-API-Key": process.env.MYOTP_API_KEY,
};
// MyOTP wants digits only, country code first, no plus, no leading zero.
const clean = (p) => (p || "").replace(/\D/g, "").replace(/^0+/, "");
router.post("/send-code", async (req, res) => {
const phone = clean(req.body.phone);
if (!/^[1-9][0-9]{6,14}$/.test(phone)) {
return res.status(400).json({ error: "invalid phone" });
}
const r = await fetch(`${API}/generate_otp`, {
method: "POST", headers,
body: JSON.stringify({ phone_number: phone, channel: "sms", otp_length: 6 }),
});
const data = await r.json();
if (!r.ok) return res.status(r.status).json({ error: data.error?.message });
pending.set(phone, data.message_id);
res.json({ status: "sent", expires_at: data.expires_at });
});
router.post("/verify-code", async (req, res) => {
const phone = clean(req.body.phone);
const message_id = pending.get(phone);
if (!message_id) return res.status(400).json({ error: "no code pending" });
const r = await fetch(`${API}/verify_otp`, {
method: "POST", headers,
body: JSON.stringify({ phone_number: phone, message_id, otp: req.body.code }),
});
const data = await r.json();
if (data.status !== "success") {
return res.status(400).json({ error: data.reason }); // "invalid" | "expired" | "not found"
}
pending.delete(phone);
res.json({ status: "verified" });
});
module.exports = router;
Plus the form and two lines in app.js. About a minute from prompt to a code arriving on my phone.
Three things in that code are the things people get wrong by hand.
The phone regex matches what the API enforces. phone_number must be digits only, 7 to 15 of them, no leading zero. The tool description carries that rule, so the model didn't guess.
Verification is keyed on message_id, not on the phone. Two codes in flight to the same number can't be confused.
The key never reaches the browser. The client posts a phone and later a code, nothing else.
The interesting part is that it tested the flow before writing it. With the MCP server attached, "send a code to my number" is a tool call. It sent one, read the response shape, then wrote code against what it had seen instead of what it remembered.
Change channel to whatsapp or telegram and nothing else moves. Worth doing where SMS is expensive or slow, which is most of South Asia, Africa and Latin America.
If your framework already owns phone auth, use its hook instead. Supabase has the Send SMS Hook, Better Auth has a sendOTP callback, and both take a MyOTP adapter without you writing the routes above. This pattern is for the plain Express or Fastify app that has nothing yet.
Disclosure again: I work at MyOTP.App. Prices and limits are on the site. If the code above breaks for you, tell me in the comments and I'll fix the post.