diff --git a/app/src/api.js b/app/src/api.js
index 105ff34f..02e214cf 100644
--- a/app/src/api.js
+++ b/app/src/api.js
@@ -228,7 +228,7 @@ export async function refreshChannel(link) {
 
 export async function encryptOTP(otp, plaintext) {
     let body = {otp, plaintext};
-    let response = await apiPost(`${OTP_API}:encrypt_otp`, body);
+    let response = await apiPost(`${OTP_API}/encrypt_otp`, body);
     if (response.status !== 200) {
         toast({
             type: 'error',
@@ -243,7 +243,7 @@ export async function encryptOTP(otp, plaintext) {
 
 export async function decryptOTP(otp, ciphertext) {
     let body = {otp, ciphertext};
-    let response = await apiPost(`${OTP_API}:decrypt_otp`, body);
+    let response = await apiPost(`${OTP_API}/decrypt_otp`, body);
     if (response.status !== 200) {
         toast({
             type: 'error',
diff --git a/modules/otp/api.py b/modules/otp/api.py
index 7e860a25..e8e79b8d 100644
--- a/modules/otp/api.py
+++ b/modules/otp/api.py
@@ -13,7 +13,7 @@ from .schema import EncryptOTPRequest, DecryptOTPRequest
 bp = get_blueprint('OTP', '/api/otp')
 
 
-@bp.post(':encrypt_otp')
+@bp.post('/encrypt_otp')
 @validate_doc(
     summary='Encrypt a message with OTP',
     consumes=EncryptOTPRequest,
@@ -23,7 +23,7 @@ async def post_encrypt_otp(_: Request, data: dict):
     return response.json(data)
 
 
-@bp.post(':decrypt_otp')
+@bp.post('/decrypt_otp')
 @validate_doc(
     summary='Decrypt a message with OTP',
     consumes=DecryptOTPRequest,