Testing

Verifications started with a sandbox (coss_test_…) key work end to end, with three differences:

• The code is always zeros (000000 with the default length), so your tests can check it.
• Nothing reaches a phone or mailbox. SMS go through the SMS simulator and emails through the sandbox's fake provider; both appear in the dashboard with their text.
• Nothing is billed.

await coss.verify.start({ to: "+15005550006" });
const { data } = await coss.verify.check({ to: "+15005550006", code: "000000" });
        
const data: VerificationCheck | null

The fraud guard runs as in live environments: +19005551234 (a premium-rate number) is blocked, and so is the Risk sandbox's Tor address 192.0.2.1 as ip. Webhooks (verification.*) are delivered as usual, and coss trigger verification.approved sends a sample one.