التحقق بـ OTP عبر واتساب

// 1. Generate OTP on your server (never the client)
function generateOTP() {
  return Math.floor(100000 + Math.random() * 900000).toString();
}

// 2. Send via Nabda OTP API
const otp = generateOTP();

const response = await fetch("https://api.nabdaotp.com/api/v1/messages/send", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${instanceToken}`
  },
  body: JSON.stringify({
    phone: "+9647701234567",  // Iraq (+964) or Syria (+963)
    message: `Your verification code is ${otp}. Valid for 5 minutes. – YourApp`
  })
});

// 3. Store hashed OTP in your DB and verify on submission
if (response.ok) {
  await storeOTP(userId, otp, Date.now() + 5 * 60000);
}