Product

OTP verification

POST /v1/verify/send and /v1/verify/check. Codes are hashed at rest. Cooldown, max attempts, and per-phone send limits are enforced server-side.

curl -X POST "$API_URL/v1/verify/send" \
  -H "Authorization: Bearer sms_test_..." \
  -H "Content-Type: application/json" \
  -d '{ "to": "+233200000001", "locale": "en" }'

OTP is routed on the dedicated queue. Never log the plaintext code. Check returns verified / expired / invalid / max attempts — not a generic 200.