What is token and how to use it?

An Authentication Token is a unique identifier that allows users to prevent fraudulent behavior and Limit the number of unnecessary OTP requests. 
This provides you with the ability to set a throttle limit.
Throttling can be used to protect your system from unnecessary OTP requests by setting a limit on the number of requests that are allowed to submit in a given amount of time. 
You can set this limit using a token system, which will allow you to specify the throttling limit for each token. To set the throttling limit, you first need to create a token. This can be done by following these steps:
Step 1 - Select the OTP section from the dashboard.

Step 2 - Select the Token option from the sidebar and click on Generate New Token.

Step 3 - Enter the token name in the pop-up appearing on your screen. Once done, your token will be generated.

Step 4 - Click on the Settings (⛭) icon corresponding to any token & you can apply Additional Settings to it.
To set the Throttle Limit for your token, simply enter the limit you require.
​
Throttle limit is used to define how many times a user can request for OTPs via API in a specific time duration. Throttle limit can be defined as number of hits per 300 seconds. 
For example- We have set a restriction of 3 OTP requests per 300 seconds for a specific user in the settings below. If the limit is surpassed, the user's IP address will be blocked for 86400 seconds.
Step 5 - In the tab next to Additional Settings (IPs), you will find the list of IP addresses for which the hits are coming from the OTP Widget. 
​
Here, you will find the different statuses of the IPs & can take the required action on them (like manually whitelisting & permanently blocking).
Normal- You will see this status if the users have requested OTPs within the specified throttle limit.
Temporary Block- When the number of OTP requests from a user exceeds the throttle limit, this status will appear, and the user will be blocked for a specified duration. The user's block will be lifted automatically after that duration.
Permanent Block- In case you identify any IP address as spam, you have the option to permanently block it.
Whitelisted- You can add genuine IP addresses to the whitelist to prevent them from being blocked in the future.
To manually add any IP, click on the plus (+) icon. Enter the IP address as per the required status/type.
Step 6 - In order to Enable/Disable any Token, you can click on the Vertical dots (⠇) from the Actions.
​


Please take note of the following:-
​
→ It is not advisable to use a Token in the OTP API since it will lead to your Server IP getting blocked (once the Throttle Limit is surpassed), instead of the User IP.

​→ However, if you still want to use it, you can pass the token value in the request's additional parameter "tokenAuth" or in the headers as "token".
​
-> You do not need to use both Token and Authkey in the OTP API, as the Auth Token already supports it.

-> It is highly recommended to use tokens with OTP Widgets only as this will help you to prevent BOT ATTACKS and this will block your end-user IP.

For instructions on integrating Tokens with OTP Widgets, please refer to this guide: https://msg91.com/help/MSG91/how-to-integrate-the-new-login-with-otp-widget