Skip to main content
OTP Edge is built with a “Secure by Default” philosophy. We implement multiple layers of cryptographic and structural security to ensure that your authentication flow remains tamper-proof.

​
Never Expose Keys

Your Secret Keys (sk_live_...) are the master credentials for your workspace.
Secret Keys must NEVER be used in frontend code. Exposing a key in a React component, mobile app, or any client-side environment allows malicious actors to exhaust your quota or send unauthorized messages on your behalf. All API requests must be initiated from a secure server environment.

​
Asymmetric Cryptography (RS256)

For enterprise-grade security, OTP Edge uses Asymmetric Cryptography to sign identity tokens.
  • Private Key Signing: We sign our Identity Tokens (JWTs) using a strictly guarded private key stored in our hardware-secured master vault.
  • Public Key Verification: You verify these tokens using our Public Key. Even if your workspace API Key were to be compromised, an attacker cannot forge identity tokens for your users because they lack the private key.

​
Automatic Key Rotation (JWKS)

To maintain long-term security, OTP Edge rotates its signing keys periodically. We provide a standard JWKS (JSON Web Key Set) endpoint that allows your application to fetch the current public keys dynamically.
  • Endpoint: https://otpedge.com/.well-known/jwks.json
By using standard libraries like jose or jsonwebtoken, your application can automatically handle key rotation without manual updates.

​
Cryptographic OTP Generation

We take the randomness of our verification codes seriously.
CSPRNG Enforcement: OTP Edge utilizes Vercel’s Edge hardware entropy pools (via crypto.randomInt) to generate Cryptographically Secure Pseudo-Random Numbers (CSPRNG). We never rely on standard Math.random() libraries, ensuring your users’ OTPs are mathematically immune to deterministic prediction attacks.

​
Advanced Infrastructure Security

In addition to cryptography, our API layer implements several protective measures:

​
IP Allowlisting

Restrict API access strictly to your backend servers. By defining an IP Allowlist in your dashboard, OTP Edge will instantly reject any request originating from an unknown IP address, neutralizing the threat of stolen API keys.

​
Atomic Database Locking

To prevent race-condition exploits (where malicious actors send thousands of concurrent requests to bypass API quotas), our billing engine utilizes PostgreSQL row-level locking (FOR UPDATE). Check-and-deduct operations are mathematically atomic.

​
Volumetric Rate Limiting

All public endpoints are guarded by strict, per-workspace rate limiters (e.g., 60 requests/minute for OTP dispatches). This prevents brute-force attacks and shields your Meta API quotas from being drained by malicious bots. Note: Bulk Marketing Campaigns initiated via the dashboard deliberately bypass these limits, ensuring your marketing scales without restriction.