> ## Documentation Index
> Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify login OTP

> Verify the OTP for the active consumer login flow, mark the selected contact channel verified, consume the flow, and return a bearer token for the consumer profile. When `remember_device` is true, the response also sets an HTTP-only trusted-device cookie that lets a future `POST /auth/login` skip OTP for the same matched profile and browser.



## OpenAPI

````yaml /api/consumer.openapi.yaml post /auth/otp/verify
openapi: 3.1.0
info:
  title: YouNegotiate Consumer API
  version: '2.0'
  description: >-
    Stateless API endpoints for consumer portal authentication and account
    access.
servers:
  - url: https://api.consumer.younegotiate.com
    description: Production
security: []
tags:
  - name: System
    description: Public consumer domain system and health endpoints.
  - name: Authentication
    description: >-
      Consumer identity matching, contact capture, OTP verification, token
      creation, and logout endpoints.
  - name: Profile - My ecoAddress
    description: Consumer profile tab for signed-in identity / ecoAddress context.
  - name: Profile - Communication Controls
    description: >-
      Consumer profile tab for communication permissions, email/mobile changes,
      and email/mobile verification.
  - name: Profile - My Billing Details
    description: >-
      Consumer profile tab for billing name and billing address details used for
      payment verification.
  - name: Profile - Personalize My Portal
    description: Consumer profile tab for portal colors and profile image personalization.
  - name: Accounts
    description: Consumer-owned account list and account detail endpoints.
  - name: Bill Pay Wallet
    description: >-
      Consumer Bill Pay Wallet saved payment profiles and scheduled payment
      method update endpoints.
  - name: Upcoming Payments
    description: >-
      Consumer My Bill Pay Calendar upcoming-payment rows and calendar display
      data.
  - name: Calendar Sync
    description: >-
      Consumer Google and Microsoft calendar connection, OAuth callback, and
      live-update endpoints.
  - name: Gift Registry
    description: >-
      Consumer Bill Pay Gift Registry account list, shared registry, and Helping
      Hand link endpoints.
  - name: EcoMailbox
    description: Consumer MyEcoMailBox list endpoints and unread sidebar badge state.
  - name: Notice Responses
    description: >-
      Consumer My Account notice-response wizard endpoints for sender details
      and account details.
paths:
  /auth/otp/verify:
    post:
      tags:
        - Authentication
      summary: Verify login OTP
      description: >-
        Verify the OTP for the active consumer login flow, mark the selected
        contact channel verified, consume the flow, and return a bearer token
        for the consumer profile. When `remember_device` is true, the response
        also sets an HTTP-only trusted-device cookie that lets a future `POST
        /auth/login` skip OTP for the same matched profile and browser.
      operationId: consumerVerifyOtp
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyConsumerOtpRequest'
            example:
              flow_token: consumer-flow-token
              otp: '123456'
              device_name: Consumer Portal
              remember_device: true
      responses:
        '200':
          description: >-
            Consumer logged in. May include a `Set-Cookie` header for the
            trusted device when requested.
          headers:
            Set-Cookie:
              description: >-
                HTTP-only trusted-device cookie returned only when
                `remember_device` is true.
              schema:
                type: string
                example: >-
                  consumer_trusted_device=selector|token; Max-Age=2592000;
                  Path=/; HttpOnly; Secure; SameSite=Lax
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConsumerAuthTokenResponse'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/TooManyRequests'
components:
  schemas:
    VerifyConsumerOtpRequest:
      type: object
      required:
        - flow_token
        - otp
      properties:
        flow_token:
          type: string
        otp:
          type: string
          pattern: ^\d{6}$
        device_name:
          type: string
          nullable: true
          maxLength: 50
          default: Consumer Portal
        remember_device:
          type: boolean
          default: false
          description: >-
            When true, the backend sets an HTTP-only trusted-device cookie after
            successful OTP verification.
    ConsumerAuthTokenResponse:
      type: object
      required:
        - message
        - meta
      properties:
        message:
          type: string
          example: Logged in.
        meta:
          type: object
          required:
            - access_token
            - refresh_token
            - token_type
            - access_token_expires_at
            - refresh_token_expires_at
          properties:
            access_token:
              type: string
            refresh_token:
              type: string
              description: >-
                Plaintext refresh token returned once. Store securely and send
                to POST /auth/refresh.
            token_type:
              type: string
              example: Bearer
            access_token_expires_at:
              type:
                - string
                - 'null'
              format: date-time
              description: >-
                Access token expiry timestamp when an expiry is assigned;
                otherwise null.
            refresh_token_expires_at:
              type: string
              format: date-time
    ValidationErrorResponse:
      type: object
      required:
        - message
        - errors
      properties:
        message:
          type: string
        errors:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
    MessageResponse:
      type: object
      required:
        - message
      properties:
        message:
          type: string
  responses:
    ValidationError:
      description: Request validation failed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationErrorResponse'
    TooManyRequests:
      description: Request was rate limited.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/MessageResponse'

````