1663832908583941.png)
What is token and how to use it?
An Authentication Token is a unique identifier that allows users to prevent fraudulent behavior and Limit the number of unnecessary OTP requests.
This provides you with the ability to set a throttle limit.
Throttling can be used to protect your system from unnecessary OTP requests by setting a limit on the number of requests that are allowed to submit in a given amount of time.
You can set this limit using a token system, which will allow you to specify the throttling limit for each token. To set the throttling limit, you first need to create a token. This can be done by following these steps:
Step 1 - Select the OTP section from the dashboard.
Step 2 - Select the Token option from the sidebar and click on Generate New Token.
Step 3 - Enter the token name in the pop-up appearing on your screen. Once done, your token will be generated.
Step 4 - Click on the Settings (⛭) icon corresponding to any token & you can apply Additional Settings to it.
To set the Throttle Limit for your token, simply enter the limit you require.
Throttle limit is used to define how many times a user can request for OTPs via API in a specific time duration. Throttle limit can be defined as number of hits per 300 seconds.
For example- We have set a restriction of 3 OTP requests per 10 seconds for a specific user in the settings below. If the limit is surpassed, the user's IP address will be blocked for 60 seconds.
Step 5 - In the tab next to Additional Settings (IPs), you will find the list of IP addresses for which the hits are coming from the OTP Widget.
Here, you will find the different statuses of the IPs & can take the required action on them (like manually whitelisting & permanently blocking).
Normal- You will see this status if the users have requested OTPs within the specified throttle limit.
Temporary Block- When the number of OTP requests from a user exceeds the throttle limit, this status will appear, and the user will be blocked for a specified duration. The user's block will be lifted automatically after that duration.
Permanent Block- In case you identify any IP address as spam, you have the option to permanently block it.
Whitelisted- You can add genuine IP addresses to the whitelist to prevent them from being blocked in the future.
To manually add any IP, click on the plus (+) icon. Enter the IP address as per the required status/type.
Step 6 - In order to Enable/Disable any Token, you can click on the Vertical dots (⠇) from the Actions.
Please take note of the following:-
→ It is not advisable to use a Token in the OTP API since it will lead to your Server IP getting blocked (once the Throttle Limit is surpassed), instead of the User IP.
→ However, if you still want to use it, you can pass the token value in the request's additional parameter "tokenAuth" or in the headers as "token".
-> You do not need to use both Token and Authkey in the OTP API, as the Auth Token already supports it.
-> It is highly recommended to use tokens with OTP Widgets only as this will help you to prevent BOT ATTACKS and this will block your end-user IP.
For instructions on integrating Tokens with OTP Widgets, please refer to this guide: https://msg91.com/help/MSG91/how-to-integrate-the-new-login-with-otp-widget
