Skip to content
Back to blog
Engineering

Verify a phone number in two API calls

By The Authevo Team6 min read

Adding phone verification to your product is genuinely two HTTPS requests — no SDK required, and anything that can send JSON over HTTPS can integrate Authevo (there’s also an official Node.js/TypeScript SDK if you’d rather use one). This post walks the complete round trip.

Step 1 — Send the code

Call POST https://api.authevo.dev/v1/otp/send from your backend with the user’s phone number in E.164 format. Authenticate with your secret key as a bearer token: Authorization: Bearer sk_…. The request body is just { "phone": "+201234567890" }.

Authevo generates a one-time code, delivers it over WhatsApp, and responds with a message id and a status. A successful response looks like { "data": { "message_id": "msg_…", "status": "sent", "expires_in": 300 } }. Store nothing client-side — the user simply reads the code from WhatsApp.

Step 2 — Verify the code

When the user types the code into your app, send it to POST https://api.authevo.dev/v1/otp/verify with the same phone number: { "phone": "+201234567890", "code": "123456" }. A match returns { "data": { "verified": true } }; a wrong or expired code comes back as an error envelope with a machine-readable error.code.

A couple of details worth wiring in from day one:

  • Branch on the HTTP status and error.code, never on the human-readable message — messages can change, codes won’t.
  • Keep the secret key on the server. It can send and verify on your account, so it must never ship in a browser or mobile bundle.
  • Billing follows your account tier — new accounts pay per message sent until their first 500 verifications, then per successful verification. See the pricing page for the details.

That is the entire integration. Delivery falls back to Telegram automatically when WhatsApp can’t be reached, and your two calls never change.