Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
The short answer: with our verification API, your system does not have to create, store or compare codes. It sends one POST /v1/sms/otp request with the customer's number; we create a random code, send it by SMS straight away and keep only its hash. When the customer types the code, your system calls POST /v1/sms/otp/{id}/verify and gets valid: yes or no. All you keep is the code's id, which starts with otp_.
Two requests are enough
|
|
|
|
curl https://api.mozout.com/v1/sms/otp \
-H "Authorization: Bearer sandbox_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: signup-7f3a9c" \
-d '{"number": "841234567"}'
The operations, one by one
| Operation | What it does | Permission |
| POST /v1/sms/otp | Create and send a code | sms:write |
| POST /v1/sms/otp/{id}/verify | Check the code the customer typed | sms:write |
| POST /v1/sms/otp/{id}/resend | Send a new code under the same id | sms:write |
| POST /v1/sms/otp/{id}/cancel | Make a pending code stop working | sms:write |
| GET /v1/sms/otp/{id} | See the status (never the code) | sms:read |
| GET /v1/sms/otp-settings | See your account's sending rules | sms:read |
| PUT /v1/sms/otp-settings | Change those rules | sms:write |
What is already done, and what is still yours
| Done by the API | Still up to your system |
| A random code of 4 to 8 digits (6 by default) | Linking the id to the customer and to what they are doing (the session, the transaction) |
| Validity from 1 to 60 minutes (5 by default) | Deciding what happens when valid is true |
| Counted attempts, 1 to 10 (5 by default) | Protecting your form from bots (see fraud through your code form) |
| Only the hash is stored, checked in constant time | A clear, honest code entry screen |
| A new code for the same number cancels the previous one | Keeping the API key on your server, never in a web page or a mobile app |
| Start in the Sandbox. With a sandbox_ key, no SMS is sent and nothing is charged, and the send response includes the code itself so you can test the check. See testing verification in the Sandbox. |
| Before the first request, SMS must be active on your account and have credits. Otherwise the API answers 403 with sms_reseller_required. Activate the service and buy credits on the SMS page in My MozOut. Each code uses the credits for its SMS, usually one; checking it costs nothing. |
|
Want to confirm numbers and logins without creating or storing codes? See how Verification SMS works. See Verification SMS |
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon) See plans |
