OTP SMS in Bangladesh that arrives while your user is still waiting

# 1. Send: BitSMS generates the code and never returns it.
curl https://sms-api.bitcommerz.com/v1/otp \
  -H "Authorization: Bearer $BITSMS_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: login-7f3a91" \
  -d '{"to": "01712345678", "app_name": "MyShop"}'
# → 202 {"otp_id": "…", "message_id": "…", "expires_at": "…"}

# 2. Verify what the user typed.
curl https://sms-api.bitcommerz.com/v1/otp/$OTP_ID/verify \
  -H "Authorization: Bearer $BITSMS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code": "482913"}'
# → 200 {"verified": true}

const headers = {
  Authorization: `Bearer ${process.env.BITSMS_API_KEY}`,
  "Content-Type": "application/json",
};

// 1. Send
const sent = await fetch("https://sms-api.bitcommerz.com/v1/otp", {
  method: "POST",
  headers: { ...headers, "Idempotency-Key": `login-${sessionId}` },
  body: JSON.stringify({ to: "01712345678", app_name: "MyShop" }),
}).then((r) => r.json());

// 2. Verify
const result = await fetch(`https://sms-api.bitcommerz.com/v1/otp/${sent.otp_id}/verify`, {
  method: "POST",
  headers,
  body: JSON.stringify({ code: userInput }),
}).then((r) => r.json());
if (result.verified) { /* sign the user in */ }

<?php
function bitsms(string $path, array $body, array $extra = []): array {
    $ch = curl_init("https://sms-api.bitcommerz.com/v1" . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => array_merge([
            "Authorization: Bearer " . getenv("BITSMS_API_KEY"),
            "Content-Type: application/json",
        ], $extra),
        CURLOPT_POSTFIELDS => json_encode($body),
    ]);
    return json_decode(curl_exec($ch), true);
}

$otp = bitsms("/otp", ["to" => "01712345678", "app_name" => "MyShop"],
              ["Idempotency-Key: login-" . session_id()]);
$check = bitsms("/otp/" . $otp["otp_id"] . "/verify", ["code" => $_POST["code"]]);
if ($check["verified"] ?? false) { /* sign the user in */ }

auth = {"Authorization": f"Bearer {os.environ['BITSMS_API_KEY']}"}

otp = requests.post(
    "https://sms-api.bitcommerz.com/v1/otp",
    headers={**auth, "Idempotency-Key": f"login-{session_id}"},
    json={"to": "01712345678", "app_name": "MyShop"},
    timeout=10,
).json()

check = requests.post(
    f"https://sms-api.bitcommerz.com/v1/otp/{otp['otp_id']}/verify",
    headers=auth,
    json={"code": user_input},
    timeout=10,
).json()
if check["verified"]:
    ...  # sign the user in

type otp struct {
	OtpID string `json:"otp_id"`
}
var sent otp
post("/v1/otp", "login-"+sessionID, map[string]any{"to": "01712345678", "app_name": "MyShop"}, &sent)

var result struct {
	Verified          bool `json:"verified"`
	AttemptsRemaining int  `json:"attempts_remaining"`
}
post("/v1/otp/"+sent.OtpID+"/verify", "", map[string]any{"code": userInput}, &result)

// post marshals body, sets Authorization (and Idempotency-Key when non-empty),
// sends to https://sms-api.bitcommerz.com and decodes the JSON response into out.