Add phone verification to an Express app with Claude Code, with a real OTP behind it

Most apps that need phone verification rebuild the same five things: a form, a send, an expiry, a retry rule and a verify step. It's not interesting code but it's load bearing. Here's what happens when Claude Code has a real OTP API attached while it writes that code. I work at MyOTP.App, the API in question.

Setup

One line, once:

claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp

The key comes from myotp.app/sign-up, 15 trial credits, no card. Allowlist your IP on the key, or * while developing.

The prompt

Add phone verification to my Express app. The user enters a phone number, gets a 6 digit code by SMS, types it in, and on success is marked verified. Use the MyOTP REST API from the server, never from the browser.

What came back

// routes/verify.js
const express = require("express");
const router = express.Router();
const pending = new Map(); // phone -> message_id

const API = "https://api.myotp.app";
const headers = {
  "Content-Type": "application/json",
  "X-API-Key": process.env.MYOTP_API_KEY,
};

// MyOTP wants digits only, country code first, no plus, no leading zero.
const clean = (p) => (p || "").replace(/\D/g, "").replace(/^0+/, "");

router.post("/send-code", async (req, res) => {
  const phone = clean(req.body.phone);
  if (!/^[1-9][0-9]{6,14}$/.test(phone)) {
    return res.status(400).json({ error: "invalid phone" });
  }
  const r = await fetch(`${API}/generate_otp`, {
    method: "POST", headers,
    body: JSON.stringify({ phone_number: phone, channel: "sms", otp_length: 6 }),
  });
  const data = await r.json();
  if (!r.ok) return res.status(r.status).json({ error: data.error?.message });
  pending.set(phone, data.message_id);
  res.json({ status: "sent", expires_at: data.expires_at });
});

router.post("/verify-code", async (req, res) => {
  const phone = clean(req.body.phone);
  const message_id = pending.get(phone);
  if (!message_id) return res.status(400).json({ error: "no code pending" });
  const r = await fetch(`${API}/verify_otp`, {
    method: "POST", headers,
    body: JSON.stringify({ phone_number: phone, message_id, otp: req.body.code }),
  });
  const data = await r.json();
  if (data.status !== "success") {
    return res.status(400).json({ error: data.reason }); // "invalid" | "expired" | "not found"
  }
  pending.delete(phone);
  res.json({ status: "verified" });
});

module.exports = router;

Plus the form and two lines in app.js. About a minute from prompt to a code arriving on my phone.

What it got right, and why

Three things in that code are the things people get wrong by hand.

The phone regex matches what the API enforces. phone_number must be digits only, 7 to 15 of them, no leading zero. The tool description carries that rule, so the model didn't guess.

Verification is keyed on message_id, not on the phone. Two codes in flight to the same number can't be confused.

The key never reaches the browser. The client posts a phone and later a code, nothing else.

The interesting part is that it tested the flow before writing it. With the MCP server attached, "send a code to my number" is a tool call. It sent one, read the response shape, then wrote code against what it had seen instead of what it remembered.

Channels

Change channel to whatsapp or telegram and nothing else moves. Worth doing where SMS is expensive or slow, which is most of South Asia, Africa and Latin America.

When not to do this

If your framework already owns phone auth, use its hook instead. Supabase has the Send SMS Hook, Better Auth has a sendOTP callback, and both take a MyOTP adapter without you writing the routes above. This pattern is for the plain Express or Fastify app that has nothing yet.

Disclosure again: I work at MyOTP.App. Prices and limits are on the site. If the code above breaks for you, tell me in the comments and I'll fix the post.