Add phone verification to an Express app with Claude Code, with a real OTP behind it

A developer at MyOTP.App demonstrated wiring the company's OTP API into an Express app via a Claude Code MCP server, letting the model send a real SMS code and inspect the response before generating the verification routes. The resulting code keys verification on the API's message_id rather than the phone number and keeps the API key server-side, with the channel swappable to WhatsApp or Telegram. The author notes the pattern targets plain Express or Fastify apps, since Supabase and Better Auth already offer SMS hooks.

Most apps that need phone verification rebuild the same five things: a form, a send, an expiry, a retry rule and a verify step. It's not interesting code but it's load bearing. Here's what happens when Claude Code has a real OTP API attached while it writes that code. I work at MyOTP.App, the API in question. One line, once: claude mcp add myotp -e MYOTP API KEY=your-key -- npx -y @myotp/mcp The key comes from myotp.app/sign-up, 15 trial credits, no card. Allowlist your IP on the key, or while developing. Add phone verification to my Express app. The user enters a phone number, gets a 6 digit code by SMS, types it in, and on success is marked verified. Use the MyOTP REST API from the server, never from the browser. js // routes/verify.js const express = require "express" ; const router = express.Router ; const pending = new Map ; // phone - message id const API = "https://api.myotp.app"; const headers = { "Content-Type": "application/json", "X-API-Key": process.env.MYOTP API KEY, }; // MyOTP wants digits only, country code first, no plus, no leading zero. const clean = p = p || "" .replace /\D/g, "" .replace /^0+/, "" ; router.post "/send-code", async req, res = { const phone = clean req.body.phone ; if /^ 1-9 0-9 {6,14}$/.test phone { return res.status 400 .json { error: "invalid phone" } ; } const r = await fetch ${API}/generate otp , { method: "POST", headers, body: JSON.stringify { phone number: phone, channel: "sms", otp length: 6 } , } ; const data = await r.json ; if r.ok return res.status r.status .json { error: data.error?.message } ; pending.set phone, data.message id ; res.json { status: "sent", expires at: data.expires at } ; } ; router.post "/verify-code", async req, res = { const phone = clean req.body.phone ; const message id = pending.get phone ; if message id return res.status 400 .json { error: "no code pending" } ; const r = await fetch ${API}/verify otp , { method: "POST", headers, body: JSON.stringify { phone number: phone, message id, otp: req.body.code } , } ; const data = await r.json ; if data.status == "success" { return res.status 400 .json { error: data.reason } ; // "invalid" | "expired" | "not found" } pending.delete phone ; res.json { status: "verified" } ; } ; module.exports = router; Plus the form and two lines in app.js . About a minute from prompt to a code arriving on my phone. Three things in that code are the things people get wrong by hand. The phone regex matches what the API enforces. phone number must be digits only, 7 to 15 of them, no leading zero. The tool description carries that rule, so the model didn't guess. Verification is keyed on message id , not on the phone. Two codes in flight to the same number can't be confused. The key never reaches the browser. The client posts a phone and later a code, nothing else. The interesting part is that it tested the flow before writing it. With the MCP server attached, "send a code to my number" is a tool call. It sent one, read the response shape, then wrote code against what it had seen instead of what it remembered. Change channel to whatsapp or telegram and nothing else moves. Worth doing where SMS is expensive or slow, which is most of South Asia, Africa and Latin America. If your framework already owns phone auth, use its hook instead. Supabase has the Send SMS Hook, Better Auth has a sendOTP callback, and both take a MyOTP adapter without you writing the routes above. This pattern is for the plain Express or Fastify app that has nothing yet. Disclosure again: I work at MyOTP.App. Prices and limits are on the site. If the code above breaks for you, tell me in the comments and I'll fix the post.