Verify (one-time codes)

Send a one-time code by SMS or WhatsApp from your own number, then check what the person typed.

For logins, sign-ups and confirming a phone number in your own app. The code goes from one of your Twilio or Exotel numbers by SMS, or from your WhatsApp number in an approved authentication template. Your provider charges for the message; each code sent costs 100 credits. Use the same API key as the rest of the API (x-api-key).

Send a code

POST

/v1/verify/send

Field	Type	Description
`phone`required	string	Who to send it to. A 10-digit number is taken as Indian.
`channel`	string	`sms` (default) or `whatsapp`.
`appName`	string	Named in the message: “482913 is your Shoppy verification code…”
`codeLength`	number	4 to 10 digits; 6 by default.
`message`	string	Your own SMS text, with `{code}` where the code goes. In India it must match your DLT template.
`dltEntityId, dltTemplateId, senderId`	string	For SMS through Exotel to Indian numbers: your DLT ids and sender id.
`templateName, templateLanguage`	string	WhatsApp: your approved authentication template (Twilio: its Content SID).
`connectionId`	string	Which of your numbers sends it; by default the first one that can.

curl -X POST https://lipivo.com/v1/verify/send \
  -H "x-api-key: $LIPIVO_API_KEY" -H "content-type: application/json" \
  -d '{"phone": "+919800000001", "appName": "Shoppy"}'

The answer has a verificationId, and expiresAt: a code lasts 10 minutes. A new code can go to the same number once every 30 seconds and five times an hour (429 TOO_SOON or TOO_MANY).

Check a code

POST

/v1/verify/check

Field	Type	Description
`code`required	string	What the person typed.
`verificationId`	string	From `/v1/verify/send`. Or give `phone` to check that number's latest code.

curl -X POST https://lipivo.com/v1/verify/check \
  -H "x-api-key: $LIPIVO_API_KEY" -H "content-type: application/json" \
  -d '{"verificationId": "vf_…", "code": "482913"}'

{"valid": true, "status": "approved"} means it matched; the code is then used up. Otherwise status is pending (with attemptsLeft), too_many_attempts after five wrong tries, or expired. We never keep the code itself, only a fingerprint of it.

← Agents API Number masking →