Verify API for OTP and two-factor authentication
What is a Verify API?
A Verify API is an HTTP interface your application calls to send and check one-time passcodes for OTP and two-factor authentication, so you never have to generate, store, expire, or rate-limit the codes yourself. Orbit by Devotel's Verify API does that over two calls: POST /api/v1/verify/send delivers a code over SMS, WhatsApp, voice, email, Viber, Telegram, or RCS and returns a verification id, and POST /api/v1/verify/check validates the digits the user entered and returns approved, failed, or expired. An ordered fallback chain advances to the next channel on its own when one does not convert, and app-based factors — TOTP authenticator apps, WebAuthn passkeys, push approvals, and backup codes — sit behind the same API. Verification runs alongside SMS, WhatsApp, RCS, voice, email, and AI agents on one platform and one pay-as-you-go bill.
Verify a user in two calls
Authenticate with your API key in the X-API-Key header. Send a code to a phone or email, then check the digits the user entered — Orbit generates, delivers, expires, and rate-limits the code for you.
# 1. Send a one-time passcode (channel defaults to "sms")
curl https://api.orbit.devotel.io/api/v1/verify/send \
-H "X-API-Key: $ORBIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "to": "+15551234567", "channel": "sms" }'
# -> { "data": { "verification_id": "vrf_..." } }
# 2. Check the code the user entered
curl https://api.orbit.devotel.io/api/v1/verify/check \
-H "X-API-Key: $ORBIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "verification_id": "vrf_...", "code": "123456" }'
# -> { "data": { "status": "approved", "attempts_remaining": 2 } }Add an ordered channels list, or a saved profile id, and the API falls back to the next channel on its own when one does not convert.
What the Orbit Verify API does
| Capability | What you get |
|---|---|
| Send a passcode over one HTTPS call | One authenticated POST to /api/v1/verify/send delivers a one-time passcode and returns a verification id. Orbit generates the code, stores only a hash of it, sets the expiry, and enforces the attempt limit, so none of that logic has to live in your app. |
| Check in a single call | POST the verification id and the digits the user entered to /api/v1/verify/check and get back approved, failed, or expired plus the attempts remaining — no code comparison or expiry bookkeeping on your side. |
| Multichannel delivery with automatic fallback | Deliver the passcode over SMS, WhatsApp, voice (a spoken code), email, Viber, Telegram, or RCS. An ordered fallback chain advances to the next channel on its own when a channel does not convert in time. |
| Reusable verification profiles | Set the fallback chain, code length, expiry, maximum attempts, and per-recipient rate limit once as a profile, then reference it by id on every send instead of repeating the configuration in code. |
| TOTP, passkey, push, and backup-code factors | Add phishing-resistant second factors behind the same API — TOTP authenticator apps, WebAuthn / FIDO2 passkeys, push approvals, and one-time backup codes — alongside SMS and email one-time passcodes. |
| Built-in anti-fraud and rate limiting | Every request is rate-limited per recipient and per tenant, scored for fraud risk, and watched for conversion anomalies, so artificial-traffic (SMS-pumping) patterns are caught before they run up a bill. |
Built for authentication and account security
Two-factor authentication at login
Send a login code after the password step and confirm it in one call, so an account takeover needs the device in the user's hand, not just a leaked password.
Passwordless sign-in
Verify a phone or email with a one-time passcode or a magic link, or register a passkey, so a customer signs in without a password at all.
Step-up confirmation for risky actions
Require a fresh passcode before a password reset, a payout, or a change of contact details, and keep the low-risk paths friction-free.
Signup phone and email verification
Confirm a real, reachable phone number or email at signup to keep fake and disposable accounts out before they cost you.
What it costs
Pay-as-you-go with no monthly Verify platform fee — you pre-pay credits and pay only for the messages a verification actually sends, at the same per-channel rate as any other message on the platform. Each channel is published per unit on the pricing page, and volume rate cards are available on request.
Verify API — frequently asked
- What is a Verify API?
- A Verify API is a hosted service your application calls to send and check one-time passcodes for OTP and two-factor authentication, instead of generating, storing, expiring, and rate-limiting the codes yourself. You make one call to send a code over a channel such as SMS, WhatsApp, voice, or email, and a second call to check the digits the user entered; the API handles code generation, delivery, expiry, attempt limits, and fraud checks.
- Which channels can Orbit deliver a one-time passcode over?
- SMS, WhatsApp, voice (a spoken code read over a call), email, Viber, Telegram, and RCS, plus flash-call verification. You can set an ordered fallback chain — for example WhatsApp first, then SMS — and the API advances to the next channel automatically if the first does not convert.
- Do I have to generate or store the codes myself?
- No. Orbit generates each code, stores only a hash of it, sets the expiry, counts attempts, and enforces a per-recipient rate limit. Your application makes a send call and a check call and reads the result; the codes never have to live in your database.
- Does Orbit support two-factor authentication beyond SMS OTP?
- Yes. Alongside SMS and email one-time passcodes, the same API supports TOTP authenticator apps, WebAuthn / FIDO2 passkeys, push approvals, and one-time backup codes, so you can offer phishing-resistant second factors without a separate provider.
- How does channel fallback work?
- You send with an ordered list of channels, or reference a saved profile that carries one. Orbit tries the first channel, and if the user has not verified by the configured timeout it advances to the next — so a passcode that fails to arrive on one channel still reaches the user on another, with no extra code on your side.
- How does Orbit protect against OTP pumping and SMS fraud?
- Every send is rate-limited per recipient and per tenant, scored for fraud risk, and watched for conversion anomalies — the sudden spikes in un-checked codes that signal artificial-traffic (SMS-pumping) fraud — so a spike is caught before it runs up a bill.
- How much does the Orbit Verify API cost?
- It is pay-as-you-go with no monthly Verify platform fee: you pay only for the messages a verification actually sends, at the same per-channel rate as any other message on the platform. See the pricing page for the current per-channel rates.
Explore more
Start verifying over the API
Verification is one part of Orbit by Devotel — voice, SMS, WhatsApp, RCS, email, video, AI agents, and customer data on one platform and one pay-as-you-go bill. Start free, or talk to our team about a volume rate card.