Send OTP

Triggers an email or SMS to send an OTP (One-Time Password) depending on the communication channel (Email, SMS or both) configured for the business on the Punchh platform.

Prerequisites
The Advanced Authentication feature must be enabled for the business in the Punchh platform; otherwise, the API request will return an error. Contact your Punchh representative for more information about this Punchh platform configuration.

For more information, see Advanced Authentication.

Headers

Accept
Type: string
required

Advertises which content types the client is able to understand
User-Agent
Type: string
required

For details, see User Agent.
Content-Type
Type: string
required

Set this header to application/json
punchh-app-device-id
Type: string
required

The app device ID helps Punchh identify each device so that certain rewards can be awarded individually to each device instead of per user. For example, the sign-up reward is given to each device ID to prevent fraudulent sign-ups so that a user cannot do repeated sign-ups from a single device to get rewards. It should not change even if the user resets a device. See the sample code to generate the punchh-app-device-id header.

Body·

required

application/json

If the email address or phone number is not provided, the API returns a communication channel missing error when both communication channels are enabled for the business.
If the phone number is provided but phone is not enabled as a communication channel for the business, the API returns a parameter missing error for phone.
If the email address is provided but the email is not enabled as a communication channel for the business, the API returns a parameter missing error for email.
If the validation method enabled for the business is not provided in the request, the API returns a validation method missing error for the validation method that is enabled.

Contact your Punchh representative for more information about these Punchh platform configurations.

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for sending OTP. The OAuth application must have the Advance Auth scope enabled.
code_challenge
Type: string
required

The base64url-encoded SHA-256 hash of the code_verifier, a random string generated by the mobile or online app. See PKCE Flow for details.
privacy_policy
Type: boolean
required

Indicates whether the user has agreed to the business's privacy policy. Possible values: true, false. This parameter must be set to "true" for a successful API call. If the parameter is not specified or set to "false", the API returns a 422 error with the message: "Please agree on given privacy policy".
terms_and_conditions
Type: boolean
required

Indicates whether the user has accepted the business's terms and conditions. Possible values: true, false. This parameter must be set to "true" for a successful API call. If the parameter is not specified or set to "false", the API returns a 422 error with the message: "Please agree on given terms and conditions".
email
Type: string

Email address of the user where the OTP will be sent. Either email or phone is required.
phone_ext
Type: string

Value represents the country code enabling support for international phone numbers. It should be preceded by a +, i.e. +1 (Country code for the US and Canada).
phone_number
Type: string

Phone number of the user where the OTP will be sent. Either email or phoneis required. Providing an incorrect phone number results in an undelivered SMS message.
validation_method
Type: string

Method used to validate the user. Possible values: otp

Responses

application/json
application/json
application/json
application/json
application/json
application/json

post/api2/password_less/token

curl https://SERVER_NAME_GOES_HERE/api2/password_less/token \
  --request POST \
  --header 'Accept: application/json' \
  --header 'User-Agent: Punchh/OnlineOrder/1.0/Web/BrowserVersion/OS_Type' \
  --header 'Content-Type: application/json' \
  --header 'punchh-app-device-id: ' \
  --data '{
  "client": "CLIENT_KEY_GOES_HERE",
  "validation_method": "otp",
  "phone_ext": "+1",
  "phone_number": "2125554626",
  "code_challenge": "CODE_CHALLENGE_GOES_HERE",
  "terms_and_conditions": true,
  "privacy_policy": true
}'

Show Schema

{
  "data": {
    "message": [
      "OTP sent successfully."
    ]
  }
}

Send OTP

Headers

Body·SendOtpRequest

Responses

Body·