Verification (OTP)

The Verify endpoints handle one-time codes end to end — generation, expiry, attempt limits and validation. You never store the code.

Create a service

A verification service holds the settings for a flow — channel, code length, expiry. Create one with POST /verify/services and reuse its id for every verification.

Start and check

POST /verify/services/{id}/verifications sends a code; POST /verify/services/{id}/checks validates the code the user typed. The code lives on our side only — you send a destination and get back a status.

cURL

curl -X POST https://api.qsendyx.com/api/v1/verify/services/{service_id}/verifications \
  -H "Authorization: Bearer $QSENDYX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "to": "+5511999998888", "channel": "sms" }'

Start a verification.

cURL

curl -X POST https://api.qsendyx.com/api/v1/verify/services/{service_id}/checks \
  -H "Authorization: Bearer $QSENDYX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "to": "+5511999998888", "code": "481902" }'

Check the code the user typed.

OTP traffic is a favourite target for pumping fraud — an attacker triggers thousands of verifications to premium destinations and collects a share of the termination fee. Rate-limit by user and by destination on your side too, not only by IP.

Previous Send SMS Next Webhooks