Changelog

Connect your own WhatsApp Business Account to a project and send OTPs from your own branded number instead of MiniMoth’s shared one. Set it up from your project’s WhatsApp Business Account card: a 3-step flow (connect via Meta, register your phone number, create the OTP template). Delivery falls back to SMS automatically if a branded send fails, same as every other OTP MiniMoth sends. It’s still in public beta — setup steps and behavior may change as we refine it.

Every phone number verified through the live API is linked to a persistent identity_id, returned from otp/verify and session/validate — a stable, opaque reference to that person for your own records, rather than keying everything off their raw phone number. Identities are scoped to your project and retained indefinitely — deleting one is available via the API, but off by default per project; turn it on from your project’s Settings card first, then DELETE /v1/identity/:id hard-deletes the identity and revokes its sessions. This doesn’t apply to the Supabase or Auth0 integrations, sandbox keys, or Test Group, since none of those mint a MiniMoth session to attach an identity to. See the Identity docs for details.

MiniMoth can now act as the delivery backend for Auth0’s custom phone provider, delivering Auth0’s own OTPs over WhatsApp first with automatic SMS fallback — using MiniMoth’s Indian delivery infrastructure and DLT compliance instead of building your own. Auth0 still owns the full OTP lifecycle (generating, verifying, and issuing the session); your app’s auth code doesn’t change. Configure it from your MiniMoth dashboard’s Auth0 Hook card, which generates the Hook URL, bearer token, and the exact Action snippet to paste into your Auth0 tenant.

Every project can now set up a Test Group — invite up to 5 real testers to preview OTPs sent through your Supabase Test Hook, no more digging through Supabase’s Auth logs to find a code. A tester logs in once with a real OTP (billed normally) and gets a 10-day session; after that, any signInWithOtp() call against their number shows the code on their screen within seconds, or as a push notification if they install the page as an app. The previews themselves are free, since Test Hook delivery never sends a real message. Set it up from a project’s Test Group card in the dashboard.

• Dashboard light theme — the dashboard now supports a light theme, toggle it from Settings → Appearance.
• Status page — MiniMoth’s live status page at status.minimoth.dev is now easier to find, a status badge linking to it is available on both the dashboard and website.
• Manage email announcements — product announcement emails can now be toggled on or off from the dashboard’s Notifications page.
• Billing page redesign — the Billing page has been revamped, with transactions grouped for a clearer, at-a-glance view.
• Limited free credits — free credits are now available for up to 3 months after signup.

Starting next month, the free credit allowance drops from ₹50 to ₹20 (about 57 OTPs). Credits you’ve already been given this month aren’t affected; this only takes effect going forward. The low-balance notification threshold has also been lowered, from ₹20 to ₹10, so a fresh ₹20 allowance doesn’t trigger a warning on your first OTP send. Your cash wallet balance, if you’ve topped up, is completely unaffected.

Every account now has a self-service monthly spend cap, configurable from the dashboard’s Billing page. Once your OTP spend for the month hits the cap, further sends are blocked until you raise it or wait for the reset on the 1st of the month — a hard stop against unexpected billing spikes from bugs, abuse, or a runaway integration. You’ll also get an email alert as you approach the limit.

MiniMoth can now act as Supabase Auth’s Send SMS Hook, delivering Supabase’s own OTPs over WhatsApp first with automatic SMS fallback — using MiniMoth’s Indian delivery infrastructure instead of Supabase’s default SMS-only provider. Supabase still owns the full OTP lifecycle (issuing, verifying, and session creation); your application code doesn’t change at all. Configure it from your MiniMoth dashboard by pointing your Supabase project’s Send SMS Hook at your project’s hook URL.

@minimoth/sdk-node wraps the OTP send/verify and session APIs in a typed client for Node.js, Express, and Next.js backends. It handles Indian phone number normalisation, automatic token refresh with request deduplication, and local JWT validation via a cached JWKS public key — so most integrations never need to call the raw REST API directly.

Access tokens are now signed with RS256 using a rotatable key pair, instead of a shared symmetric secret. Public keys are served at GET /.well-known/jwks.json, so SDKs and backends can verify tokens locally — with zero network round trip — instead of calling session/validate for every request. Key rotation is supported without invalidating tokens signed under the previous key.

Every OTP now attempts delivery over WhatsApp first, falling back to SMS automatically within seconds if the WhatsApp API call fails — no configuration needed on your side. Both channels run on MiniMoth’s own WhatsApp Business Account and SMS sender ID, so you never need to register your own. This typically means higher delivery rates and lower cost per OTP than SMS-only providers.

Every project now gets a mm_test_ API key alongside its live mm_live_ key, for integrating without spending real credits or sending real messages. Test-mode OTPs use a fixed code (000000), skip WhatsApp/SMS delivery entirely, and carry a higher rate-limit budget suited to development traffic. The dashboard’s new Playground lets you try the full send → verify flow interactively, without writing any code first.

Refresh tokens now rotate on every use, with a 10-second grace window to tolerate concurrent refresh calls from the same client. Because of this, POST /v1/session/refresh now returns a new refresh_token in its response body — not just a new access_token — and callers must save and use it on the next refresh. Continuing to send the old refresh token after the grace window closes is treated as reuse and revokes the session.

MiniMoth now issues short-lived access tokens alongside long-lived refresh tokens for every verified OTP session. POST /v1/session/validate checks an access token in under a millisecond via cache; POST /v1/session/refresh rotates both tokens; POST /v1/session/logout revokes a session immediately. This replaces a single long-lived token with the access/refresh pattern used by most modern auth systems.