Phone OTP Auth

What phone OTP is

OTP (one-time password) lets customers sign in with their phone number instead of email and password. StoreOS sends a 4-digit SMS code; the customer enters it to get a JWT session.

Best for: Mobile-first storefronts in Bangladesh and markets where phone is the primary identity.

How it works

1. Customer enters phone     →  sendOtp
2. SMS with 4-digit code     →  (StoreOS + SMS provider)
3. Customer enters code      →  verifyOtp
4. accessToken returned      →  your app saves token
5. Customer is signed in     →  getMe, getMyOrders, etc.

New customers: sendOtp returns isNewCustomer: true — show a name field on verify.
Returning customers: verify with phone + OTP only.

SDK implementation

import { store } from "@/lib/store";

// Step 1 — send code
const { isNewCustomer } = await store.sendOtp({
  phoneNumber: "+8801XXXXXXXXX",
});

// Step 2 — verify (show name field if isNewCustomer)
const { accessToken, user } = await store.verifyOtp({
  phoneNumber: "+8801XXXXXXXXX",
  otp: "1234",
  name: isNewCustomer ? "Jane Doe" : undefined,
});

// Step 3 — persist session in YOUR app
const token = store.getAccessToken();
// → cookie, localStorage, etc.

GraphQL equivalent

mutation SendOtp($input: SendOtpInput!) {
  sendOtp(input: $input) { success message isNewCustomer }
}

mutation VerifyOtp($input: VerifyOtpInput!) {
  verifyOtpToLogin(input: $input) {
    accessToken
    user { _id name phoneNumber }
  }
}