Verify once.
Trust always.

AkidOTP is a multi-channel verification API. You verify your own users' phone numbers and email addresses over four channels — WhatsApp, Telegram, SMS, and Email. Phone channels use a reverse flow (the user sends a code to AkidOTP); Email uses a forward flow (AkidOTP emails a code the user types back). You call one REST API with your API key and get the result by polling or webhook.

In the reverse flow (WhatsApp, Telegram, SMS) AkidOTP never sends a message to the user — you display a short code and the user sends that code to AkidOTP from their own device, which proves they own the number. In the forward flow (Email) AkidOTP emails a 6-digit code and the user types it back for you to confirm.

Create a developer account, then generate an API key from the dashboard (or via POST /api/auth/keys). Send it on every verification request in the X-API-Key header. No other identifier is needed — your account and plan are resolved from the key.

X-API-Key: YOUR_API_KEY

Call POST /api/mobileverify/start with the user's phone. The response gives you a 6-digit code, a socketRoom session handle, and a whatsappLink (wa.me deep link). Show the code and open the link so the user sends it to AkidOTP on WhatsApp, then read the result by polling the status endpoint or via webhook.

curl -X POST https://akidotp.com/api/mobileverify/start \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"+218912345678"}'

Use the same POST /api/mobileverify/start endpoint; the response includes a telegramLink (t.me bot link). The user opens it, taps Start, and shares their contact with the AkidOTP bot. Track the result with the same status endpoint or a webhook.

Again call POST /api/mobileverify/start; if your plan includes SMS the response adds smsNumber, smsBody, and ready-made smsLink / smsLinkIOS deep links. The user taps the link (or texts the code to the number) to send it to AkidOTP. Get the result via polling or webhook.

Call POST /api/verify/email/send with phone and email to send a 6-digit code, then POST /api/verify/email/confirm with email and code. On success the response returns verified: true plus a signed JWT in the token field. Email is a synchronous check — it never fires a webhook.

POST /api/verify/email/send     {"phone":"+218912345678","email":"user@example.com"}
POST /api/verify/email/confirm  {"email":"user@example.com","code":"483920"}
→ {"verified":true,"phone":"...","email":"...","token":"JWT_TOKEN"}

Important: the email verification token proves email ownership only — it does not prove phone ownership. The token contains no phone claim; do not treat email verification as proof that the user owns any phone number.

Two ways. Polling: GET /api/mobileverify/status?room=SOCKET_ROOM returns verified: true with the phone when done, or a pending / expired / mismatch state otherwise. Webhook: if you set a webhook URL on your key, AkidOTP POSTs a signed JSON notification on success.

Verify the webhook by computing HMAC-SHA256 of the raw request body with your key's webhook secret and comparing it to the X-AkidOTP-Signature header (hex). Email does not use webhooks — its result is returned synchronously.

X-AkidOTP-Signature = HMAC_SHA256(webhook_secret, raw_request_body)   // hex

The signed webhook is the authoritative, one-shot verification result — rely on it for authentication decisions. The /status polling endpoint is advisory: a verified result is served only briefly (single-use, with a short ~30s grace) and then withheld, so a stale poll cannot be replayed.

Codes are short-lived and expire after a few minutes. Email verification allows a limited number of attempts — after that the code is invalidated and you must request a new one. There is no separate resend endpoint: calling start again generates a fresh code and invalidates the previous one (start is not idempotent).

Free: Email only, 1,000 verifications/month. Starter: all four channels, 10,000/month including 50 SMS. Growth: all four channels, 100,000/month including 200 SMS. Enterprise: all four channels, unlimited. Reverse channels (WhatsApp, Telegram, SMS) require Starter or higher; Email is on every plan. Your overall monthly limit and SMS allowance are enforced, and upgrades apply on your very next request.

Handle 401 for a missing or invalid API key, 403 when a channel isn't on your plan, 429 for rate-limit or monthly-limit exceeded, 400 for bad input (e.g. a missing phone), and 401 for an invalid or expired email code. Every error is JSON with an error message.

There is no separate sandbox: integrate against the live endpoints and verify with your own phone or email. Email verification works on every plan (including Free), so it's the fastest way to test the full send → confirm flow end-to-end. Reverse channels require Starter or higher to test.