Verify phone numbers with one-time codes.

Phone verification proves someone has a number, at sign-up or before a sensitive action. It also attracts SMS pumping: scripts request codes for numbers whose owners earn money from every text, and you pay for messages nobody reads. Building it yourself means generating and hashing codes, counting attempts, handling resends and expiry, and working out who's abusing your form.

coss.com covers this with three products on one key: Verify for the codes and the fraud guard, SMS if you'd rather send from your own number, and Risk for lists of who to allow or block and for checking the line itself.

// Optional: look at the line before spending a code on it.
const { data: line } = await coss.risk.checkPhone(form.phone);
if (line?.line_type === "non_fixed_voip") throw new Error("Please use a mobile number.");

// 1. Send a code. The fraud guard runs first.
const { error } = await coss.verify.start({
  to: form.phone,
  ip: request.ip, // the end user's address, not your server's
  user_id: "user_42",
});
if (error?.code === "verification_blocked") throw new Error("We can't send a code right now.");

// 2. Check the code they typed, on your backend.
const { data: check } = await coss.verify.check({ to: form.phone, code: form.code });
if (check?.valid) {
  // The number is theirs.
}

Read more in the fraud guard, phone checks and the API reference.

1. Choose a paid plan. Live SMS is available on paid plans.
2. Start sending. coss.com registered its shared numbers with carriers for one-time codes, and each destination always gets its codes from the same number. The messages are billed to you by country once a carrier takes them. See SMS codes.
3. Use your own number if you'd rather. Choose one in Verify's settings when your users should see your number, or for countries the shared numbers don't reach. It must be registered and approved, and its messages appear under SMS in your environment and are billed as SMS. See numbers and registration.

You can see which of your own numbers are ready to send:

const { data: numbers } = await coss.sms.numbers.list();
const ready = numbers?.data.filter((number) => number.can_send);

You can also build against a sandbox environment, where messages are simulated and the code is always zeros. See testing Verify.

await coss.verify.start({ to: "+15005550006" });
const { data } = await coss.verify.check({ to: "+15005550006", code: "000000" });

A blocked verification costs nothing, and one that fails or expires costs only the messages actually sent. Every plan includes 100 risk phone checks a month. Sandbox verifications are never billed. See pricing for the plans.