Ship the first OTP flow from your Next.js backend.

LOGINRELAY_API_BASE_URL=https://loginrelay.com
LOGINRELAY_API_KEY=lr_test_xxxxx_secret
LOGINRELAY_FROM_ADDRESS=auth@project-a.com

curl -X POST https://loginrelay.com/v1/send-otp \
  -H "Authorization: Bearer lr_test_xxxxx_secret" \
  -H "Content-Type: application/json" \
  --data '{
    "from": "auth@project-a.com",
    "email": "builder@example.com",
    "purpose": "login",
    "metadata": {
      "appUserId": "user_123"
    }
  }'

# 202 Accepted
{
  "ok": true,
  "challengeId": "chl_123",
  "expiresAt": "2026-03-21T12:00:00Z"
}

curl -X POST https://loginrelay.com/v1/verify-otp \
  -H "Authorization: Bearer lr_test_xxxxx_secret" \
  -H "Content-Type: application/json" \
  --data '{
    "email": "builder@example.com",
    "code": "123456",
    "challengeId": "chl_123",
    "purpose": "login"
  }'

# 200 OK
{
  "ok": true,
  "verified": true,
  "challengeId": "chl_123",
  "verifiedAt": "2026-03-21T12:02:00Z",
  "assertion": {
    "token": "signed_assertion_here",
    "expiresAt": "2026-03-21T12:07:00Z"
  }
}

const baseUrl =
  process.env.LOGINRELAY_API_BASE_URL ?? "https://loginrelay.com";

export async function sendOtp(email: string) {
  const response = await fetch(`${baseUrl}/v1/send-otp`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.LOGINRELAY_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      from: process.env.LOGINRELAY_FROM_ADDRESS,
      email,
      purpose: "login",
    }),
    cache: "no-store",
  });

  return response.json();
}

export async function verifyOtp(
  email: string,
  code: string,
  challengeId: string,
) {
  const response = await fetch(`${baseUrl}/v1/verify-otp`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.LOGINRELAY_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      email,
      code,
      challengeId,
      purpose: "login",
    }),
    cache: "no-store",
  });

  return response.json();
}