How to Test an OTP API Using Postman
Let’s understand the testing process with a simple example.
Assume an application has two endpoints:
1. Generate OTP
POST /api/otp/generate
Sample request:
{
"mobileNumber": "9999999999"
}Possible successful response:
{
"message": "OTP request processed successfully",
"requestId": "OTP-TEST-101"
}2. Verify OTP
POST /api/otp/verify
Sample request:
{
"requestId": "OTP-TEST-101",
"otp": "482615"
}Possible successful response:
{
"verified": true,
"message": "OTP verified successfully"
}These endpoints, fields, and responses are illustrative examples. Your actual API may use a different structure.
Step 1: Test the OTP Generation API
Open Postman and create a new request.
- Select the POST method.
- Enter the OTP generation endpoint.
- Add the required headers, such as
Content-Type: application/json. - Select Body → raw → JSON.
- Enter the test mobile number.
- Click Send.
Check the following:
- Is the request processed according to the API specification?
- Is the expected HTTP status code returned?
- Is the response structure correct?
- Is the OTP delivered through the configured channel?
- Does the system enforce any required limits on OTP generation?
Do not assume that receiving HTTP 200 always means an OTP was successfully delivered. Check the API contract and delivery status where available.
Step 2: Test the OTP Verification API
Copy the request ID or other required reference returned by the generation API.
Enter the valid OTP using the test environment’s approved OTP retrieval method, then send the verification request.
Validate the following:
- The correct OTP is accepted.
- The response contains the expected verification result.
- The HTTP status code matches the API specification.
- The response does not expose sensitive information.
- A successful verification changes the appropriate application state.
For security reasons, do not assume that an OTP will be returned in the API response. Production systems should not expose it unnecessarily.
Step 3: Test an Invalid OTP
Send an incorrect OTP to the verification endpoint.
Example request:
{
"requestId": "OTP-TEST-101",
"otp": "111111"
}Expected behavior:
- The OTP should be rejected.
- The response should indicate that verification failed.
- The user should not be marked as verified.
- Failed attempts should be counted if the system has an attempt limit.
The exact status code and error message should follow the API specification.