The OTP Widget setup relies on three pieces of configuration: Widget ID, tokenAuth, and authKey. Widget ID is fine. The other two cause real confusion for first-time integrators, for two separate reasons.
- Dashboard vs. docs naming mismatch
On the dashboard, tokenAuth is simply labeled "Token." This makes it unclear whether "Token" refers to the same value as tokenAuth used in the SDKs/API, or something else entirely.
Screenshot: dashboard showing "Token" label
Screenshot: SDK config showing the same "Token" as the "tokenAuth"
-
Neither name is self-explanatory
Nothing about tokenAuth or authKey indicates which one is safe to expose (e.g. client-side/frontend) and which must stay server-side. More descriptive pairings e.g. authToken / authSecret, or apiToken / apiSecret, would make the security boundary obvious from the name alone, without needing to cross-reference docs.
-
Docs reference the wrong credential
Several OTP Widget doc pages reference authKey in request examples, but it should be tokenAuth for the OTP Widget specifically:
https://docs.msg91.com/otp-widget/send-otp-1
https://docs.msg91.com/otp-widget/retry-otp
https://docs.msg91.com/otp-widget/verify-otp
Screenshots attached for send-otp-1 and retry-otp; verify-otp has the same issue.
If authKey is actually a valid alternative for these calls, that should be stated explicitly. Right now, there's no indication either way, so it just reads as a documentation error.
Impact: Together, these inconsistencies make the first integration noticeably harder than it needs to be. New users have to guess which credential a given doc example actually wants, and whether "Token" on the dashboard is the same thing referenced elsewhere.
Happy to share more observations if useful; this is the first batch :)
The OTP Widget setup relies on three pieces of configuration: Widget ID, tokenAuth, and authKey. Widget ID is fine. The other two cause real confusion for first-time integrators, for two separate reasons.
On the dashboard, tokenAuth is simply labeled "Token." This makes it unclear whether "Token" refers to the same value as tokenAuth used in the SDKs/API, or something else entirely.
Screenshot: dashboard showing "Token" label
Screenshot: SDK config showing the same "Token" as the "tokenAuth"
Neither name is self-explanatory
Nothing about tokenAuth or authKey indicates which one is safe to expose (e.g. client-side/frontend) and which must stay server-side. More descriptive pairings e.g. authToken / authSecret, or apiToken / apiSecret, would make the security boundary obvious from the name alone, without needing to cross-reference docs.
Docs reference the wrong credential
Several OTP Widget doc pages reference authKey in request examples, but it should be tokenAuth for the OTP Widget specifically:
https://docs.msg91.com/otp-widget/send-otp-1
https://docs.msg91.com/otp-widget/retry-otp
https://docs.msg91.com/otp-widget/verify-otp
Screenshots attached for send-otp-1 and retry-otp; verify-otp has the same issue.
If authKey is actually a valid alternative for these calls, that should be stated explicitly. Right now, there's no indication either way, so it just reads as a documentation error.
Impact: Together, these inconsistencies make the first integration noticeably harder than it needs to be. New users have to guess which credential a given doc example actually wants, and whether "Token" on the dashboard is the same thing referenced elsewhere.
Happy to share more observations if useful; this is the first batch :)