Verify API (OTP & 2FA)
One endpoint to verify a phone number, email or device - SMS, voice, WhatsApp, flash call, email and silent network authentication, with automatic failover and fraud controls built in.
6
Verification channels
200+
Countries covered
< 5 s
Median OTP delivery
What is Verify API (OTP & 2FA)?
Verify API reduces the whole problem of proving that a user controls a phone number or email address to two requests. POST /v2/verifications with a destination and your preferred channel; Dollu generates the code, selects a template in the user's language, delivers it and manages expiry and retries. POST /v2/verifications/{id}/check with what the user typed and you receive a verdict. No code generation, no storage of secrets, no per-country templates and no relationships with SMS operators for you to maintain.
Behind that single interface sit six channels: SMS, a voice call with a spoken code, WhatsApp, flash call (a missed call whose last digits are the code, read automatically on Android), email and silent network authentication, which confirms the SIM directly with the mobile operator over the data connection with no user input at all. You set a channel policy - for example silent authentication first, then SMS, then voice after 30 seconds - and the platform fails over automatically when a channel is unavailable, blocked or simply not converting in that country.
Verification traffic attracts fraud. Artificially inflated traffic (AIT), where bots trigger OTPs to premium-rate ranges to farm termination revenue, has cost businesses six-figure sums in a weekend. Verify API includes velocity limits per number, IP and account, real-time detection of AIT patterns, blocking of unallocated and premium ranges, a built-in number lookup that checks number type, carrier and roaming status before you spend anything, and a country shield that pauses sending when the conversion rate collapses. You pay for what converts, not for what fraudsters trigger.
Because delivery runs over Dollu's own 800+ direct SMS connections and voice interconnects, codes arrive in seconds with sender IDs pre-registered under DLT, 10DLC and country regulations. Conversion analytics per country, channel and operator, webhooks for every state change, SDKs for Node.js, Python, Java, Go, PHP and .NET and a sandbox with fixed test codes let you build, measure and tune verification flows without a project plan or a telecom team.
CPaaS request and event flow: REST in, webhooks out.
Why choose Dollu for verify api.
The advantages of buying from a carrier that owns its network, interconnects and operations - rather than a reseller.
Higher conversion, fewer tickets
Direct routes, silent authentication and automatic failover mean more users complete verification on the first attempt, and fewer write to support because a code never arrived.
Fraud losses stopped at source
AIT detection, velocity limits, premium-range blocking and per-country conversion shields protect your budget from bot-driven OTP pumping without you writing a single rule.
Nothing sensitive to store
Codes are generated, hashed and expired on our side; your application only ever handles a verification ID and a verdict, which simplifies audits and reduces breach exposure.
Pay for results
Choose per-successful-verification pricing so failed deliveries, expired codes and fraudulent attempts cost you nothing, or per-attempt pricing where that is cheaper for your mix.
Live in an afternoon
Two endpoints, six SDKs, ready-made templates and a sandbox with fixed test codes mean sign-up 2FA can ship the same day you read the docs.
Capabilities in detail.
Everything included with Verify API (OTP & 2FA) - the platform features, options and controls you get from day one.
- 01
Multi-channel OTP delivery
SMS with pre-registered sender IDs, voice calls with a spoken code in the user's language, WhatsApp authentication templates, flash call for Android auto-read and email - selectable per request or per policy.
- 02
Silent network authentication
Verifies possession of the SIM by exchanging a signed token with the mobile operator over the data connection; no code, no user action, typically under two seconds; available on participating operators in 30+ countries.
- 03
Channel policies and failover
Define ordered channel lists with per-step timeouts (for example SNA, then SMS, then voice after 30 s); the platform advances automatically on delivery failure, timeout or known filtering in that country.
- 04
Fraud and AIT protection
Per-number, per-IP and per-account velocity limits, machine-learned AIT pattern detection, blocking of unallocated and premium ranges and country conversion shields that pause sending when success rates collapse.
- 05
Number lookup and HLR
GET /v2/lookup/{number} returns number type, current operator, ported status, roaming and reachability from live HLR queries; run it before every send or as a standalone endpoint for data hygiene.
- 06
Templates and localisation
Ready-made templates in 40+ languages with your brand name, configurable code length (4–10 digits or alphanumeric), TTL from 30 s to 15 min, maximum attempts and app-hash support for Android auto-fill.
- 07
Webhooks and reporting
verification.sent, delivered, approved, expired and failed events signed with HMAC-SHA256; dashboards for conversion, latency and cost per country, channel and operator; CSV and API export.
- 08
PSD2 SCA and compliance
Dynamic linking of transaction details into the message, configurable data retention, GDPR-compliant processing in region and ISO 27001 and SOC 2 controls for regulated verification flows.
How it works.
From first conversation to live traffic - a tracked, engineer-led onboarding with a named owner at every step.
- Step 01
Configure a verification profile
In the console or via API, set your brand name, default channels and failover order, code length, TTL and attempt limits. Sender IDs are pre-registered by Dollu in each country.
- Step 02
Start a verification
Call POST /v2/verifications with the phone number or email and, optionally, a channel or policy override. The response returns a verification ID and the channel actually used.
- Step 03
Check the code
Call POST /v2/verifications/{id}/check with the user's input. The API returns approved, rejected or expired, and your webhook receives the same event for audit.
- Step 04
Measure and tune
Watch conversion by country and channel, adjust the failover policy where a channel underperforms and let fraud shields and lookups keep spend aligned with real users.
Who uses this and why.
Typical deployments across carriers, enterprises, platforms and contact centres.
Sign-up and login 2FA
Verify new users at registration and add a second factor at login with the channel most likely to convert in each market.
Transaction confirmation and PSD2 SCA
Confirm payments, transfers and limit changes with codes dynamically linked to the transaction amount and payee, delivered in seconds.
Account recovery and device change
Prove ownership before password resets, new-device logins or SIM changes, using silent authentication where available and voice fallback for users without data.
Marketplace and gig-economy trust
Verify buyers, sellers, drivers and couriers to keep duplicate and fraudulent accounts off your platform, with lookups to reject virtual and disposable numbers.
Passwordless authentication
Replace passwords entirely with silent network authentication or one-tap flash-call verification on mobile, falling back to OTP on desktop.
Technical & commercial specifications.
Key parameters at a glance. Ask us for the full service description and SLA document.
| Endpoints | POST /v2/verifications; POST /v2/verifications/{id}/check; GET /v2/lookup/{number} |
|---|---|
| Channels | SMS, voice, WhatsApp, flash call, email, silent network authentication |
| Coverage | 200+ countries for SMS/voice; SNA on participating operators in 30+ countries |
| Code options | 4–10 digits or alphanumeric; TTL 30 s to 15 min; configurable attempt limit |
| Languages | 40+ template languages; custom brand name and app hash |
| Fraud controls | Velocity limits, AIT detection, premium/unallocated blocking, country shields |
| Webhooks | verification.sent, delivered, approved, expired, failed; HMAC-SHA256 signed |
| SDKs | Node.js, Python, Java, Go, PHP, .NET |
| Compliance | GDPR, ISO 27001, SOC 2, DLT, 10DLC, PSD2 SCA dynamic linking |
| Billing | Per successful verification or per attempt; lookups billed per query |
How APIs / CPaaS are priced.
APIs are usage-based: per minute, per message, per verification, per participant-minute or per email - at carrier pricing, because Dollu’s own network sits underneath the endpoints.
We publish the model, not a public rate card - actual rates depend on destination, route class, volume and regulatory cost. See how every Dollu service is priced.
- Free sandbox for development and testing
- Sub-account and reseller rate decks
- Committed-spend discounts by monthly usage
- No platform fee at entry volumes
- Numbers added at rental + usage
- Billing
- Metered per unit; prepaid balance or postpaid invoicing; usage visible in real time in the portal and API
- Commitment
- None; committed monthly spend earns tiered discounts
Verify API - your questions answered.
The questions customers and carriers ask us most often before they interconnect. If yours is not here, our team answers within one business day.
Still have a question?
Ask our solutions teamRelated services.
Services customers commonly combine with Verify API (OTP & 2FA).
Stop building OTP plumbing.
Get a sandbox key with fixed test codes and ship verification today, or ask [email protected] for a conversion benchmark on your top countries.
