# Add phone verification to an Express app with Claude Code, with a real OTP behind it

> Source: <https://dev.to/rayas/add-phone-verification-to-an-express-app-with-claude-code-with-a-real-otp-behind-it-4k81>
> Published: 2026-09-13 13:09:11+00:00

Most apps that need phone verification rebuild the same five things: a form, a send, an expiry, a retry rule and a verify step. It's not interesting code but it's load bearing. Here's what happens when Claude Code has a real OTP API attached while it writes that code. I work at MyOTP.App, the API in question.

One line, once:

```
claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp
```

The key comes from myotp.app/sign-up, 15 trial credits, no card. Allowlist your IP on the key, or `*` while developing.

Add phone verification to my Express app. The user enters a phone number, gets a 6 digit code by SMS, types it in, and on success is marked verified. Use the MyOTP REST API from the server, never from the browser.

``` js
// routes/verify.js
const express = require("express");
const router = express.Router();
const pending = new Map(); // phone -> message_id

const API = "https://api.myotp.app";
const headers = {
  "Content-Type": "application/json",
  "X-API-Key": process.env.MYOTP_API_KEY,
};

// MyOTP wants digits only, country code first, no plus, no leading zero.
const clean = (p) => (p || "").replace(/\D/g, "").replace(/^0+/, "");

router.post("/send-code", async (req, res) => {
  const phone = clean(req.body.phone);
  if (!/^[1-9][0-9]{6,14}$/.test(phone)) {
    return res.status(400).json({ error: "invalid phone" });
  }
  const r = await fetch(`${API}/generate_otp`, {
    method: "POST", headers,
    body: JSON.stringify({ phone_number: phone, channel: "sms", otp_length: 6 }),
  });
  const data = await r.json();
  if (!r.ok) return res.status(r.status).json({ error: data.error?.message });
  pending.set(phone, data.message_id);
  res.json({ status: "sent", expires_at: data.expires_at });
});

router.post("/verify-code", async (req, res) => {
  const phone = clean(req.body.phone);
  const message_id = pending.get(phone);
  if (!message_id) return res.status(400).json({ error: "no code pending" });
  const r = await fetch(`${API}/verify_otp`, {
    method: "POST", headers,
    body: JSON.stringify({ phone_number: phone, message_id, otp: req.body.code }),
  });
  const data = await r.json();
  if (data.status !== "success") {
    return res.status(400).json({ error: data.reason }); // "invalid" | "expired" | "not found"
  }
  pending.delete(phone);
  res.json({ status: "verified" });
});

module.exports = router;
```

Plus the form and two lines in `app.js`. About a minute from prompt to a code arriving on my phone.

Three things in that code are the things people get wrong by hand.

The phone regex matches what the API enforces. `phone_number` must be digits only, 7 to 15 of them, no leading zero. The tool description carries that rule, so the model didn't guess.

Verification is keyed on `message_id`, not on the phone. Two codes in flight to the same number can't be confused.

The key never reaches the browser. The client posts a phone and later a code, nothing else.

The interesting part is that it tested the flow before writing it. With the MCP server attached, "send a code to my number" is a tool call. It sent one, read the response shape, then wrote code against what it had seen instead of what it remembered.

Change `channel` to `whatsapp` or `telegram` and nothing else moves. Worth doing where SMS is expensive or slow, which is most of South Asia, Africa and Latin America.

If your framework already owns phone auth, use its hook instead. Supabase has the Send SMS Hook, Better Auth has a `sendOTP` callback, and both take a MyOTP adapter without you writing the routes above. This pattern is for the plain Express or Fastify app that has nothing yet.

Disclosure again: I work at MyOTP.App. Prices and limits are on the site. If the code above breaks for you, tell me in the comments and I'll fix the post.