Get OTP
Start the income tax portal OTP leg for ITR access. Server-side POST with PAN and portal password fields as required by your integration.
API reference
JWT Bearer token authentication. Obtain a token from the KwikID dashboard.
In: header
Pan number
stringITR Login password
stringResponse Body
curl -X POST "https://__mock__/verification/v2/itr/get_otp" \ -H "Content-Type: application/json" \ -d '{}'{
"otp_status": "string"
}{
"detail": {},
"message": "string"
}{
"detail": {},
"message": "string"
}{
"error": "string"
}Overview
Call POST /verification/v2/itr/get_otp from your backend to request an OTP on the income tax portal path your product uses. Send Authorization: Bearer <token> and JSON with pan and password (ITR login password) as in OpenAPI.
On 200 OK, check otp_status for whether an OTP was triggered. Follow your UX to collect the user-entered OTP and continue the flow toward Get ITR Data.
Key features
- Starts ITR session: First server step before fetching ITR JSON.
- Bearer only on server: Never expose the API token to the browser.
Implementation
Step 1: Call from your backend
POST /verification/v2/itr/get_otp HTTP/1.1
Host: <verification-api-base-url>
Authorization: Bearer <token>
Content-Type: application/json
{
"pan": "ABCDE1234F",
"password": "<itr-portal-password>"
}Warning: Collect and transmit portal credentials only over HTTPS and only in flows your legal team approves.
Step 2: Continue the flow
After the user receives the OTP, complete portal steps until you obtain the ITR AccessToken required by Get ITR Data.
Error handling
| HTTP status | When |
|---|---|
| 400 | Validation error. |
| 401 | Invalid Bearer token. |
| 500 | Server error. |
Benefits
- Automates the OTP initiation step for ITR-backed verification.
Next steps
Authenticate POST
Verify PAN with holder demographics and explicit consent. Server-side POST with Bearer. Returns message plus transaction ids for reconciliation.
PAN Aadhaar Link Status POST
Check whether a PAN is linked to an Aadhaar for the pair you submit. Server-side POST with Bearer auth and consent.