Phone verification by SMS in two API calls
Meser 10 Verify creates the code, sends it, checks it and limits guesses and repeat sends. You make two calls, one to send and one to check, and you never store codes yourself.
Get startedWhat you do not have to build
Creating and storing codes
A 6-digit code is created on our side and stored only as a hash. It is never returned to you in any response.
Expiry
A code is valid for 5 minutes by default. You can set anything from 1 to 15 minutes on each send.
Limit on guesses
After 5 wrong attempts the request is blocked, and every wrong answer tells you how many attempts are left.
Limit on repeat sends
Per number: 30 seconds between sends, up to 3 in 10 minutes and up to 10 in 24 hours. Per account: up to 2,000 sends a day.
Message text without links
Ready texts exist in Hebrew and English. You can write your own, but it must contain the code once and cannot contain a link or a phone number. This makes it harder to misuse the service for impersonation messages.
Phone numbers
The number is stored only as a keyed hash (HMAC) with a masked form for display, and deleted after 48 hours. Example: 050*****67.
Quick start
- Open a Meser 10 account and issue an API key in the advanced settings.
- Verify a sender name (2 to 11 Latin letters, digits or spaces) or a sender number.
- Send a code, then check what the user typed.
Send a code
curl -sS -X POST "https://verify.mesereser.com/v1/send" \
-H "ApiKey: $MESER10_API_KEY" \
-H "Content-Type: application/json" \
-d '{"phone":"0501234567","from":"MyShop","lang":"en"}'
{"ok":true,"id":"<request-id>","expires_in":300,"phone":"050*****67"}
Check the code the user typed
curl -sS -X POST "https://verify.mesereser.com/v1/check" \
-H "ApiKey: $MESER10_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id":"<request-id>","code":"481902","phone":"0501234567"}'
{"ok":true,"verified":true,"phone":"050*****67"}
The phone field in the check is optional. When you send it, the code is accepted only if it belongs to that number, and a number that does not match counts as a wrong attempt.
Call the service from your server only. The key is a full account key and must never be placed in a browser or an app.
Check responses
| Response | Meaning |
|---|---|
verified: true | The code is correct. You can mark the number as verified. |
wrong_code | Wrong code. Includes attempts_left. When it is 0, that was the fifth attempt and the request is now blocked. |
expired | The code expired, or a newer code was sent to the same number since. Send or check the new code. |
too_many_attempts | No attempts left (happens when several checks arrive at the same time). Send a new code. |
blocked | The request was already blocked earlier. Send a new code. |
not_found | There is no request with this id. |
already_used | The code was already verified once and will not be accepted again. |
phone_mismatch | The number sent with the check is not the number the code went to. |
On send: too_soon (with retry_after) if less than 30 seconds have passed, phone_rate_limited if you passed the limit for that number, account_daily_limit if the account reached 2,000 for the day, and too_many_requests for too many calls per minute. upstream_uncertain means it is not certain the SMS went out; the code stays valid and can still be checked by its id.
Cost and access
The SMS is sent through your own Meser 10 account and charged there like any SMS.
The service is opening gradually. To get access for your account, contact support. This page in Hebrew.
Questions
How is this different from sending a code through the regular API?
With the regular API you create, store and check the code and limit attempts yourself. Here all of that happens on our side, and you get a yes or no.
Can I change the message text?
Yes, with the template field. The text must contain {code} once, no links and no phone numbers, and fit in a single SMS.
Which numbers can I send to?
Israeli mobile numbers only (05X, also in 972 format). The restriction prevents misuse for expensive international sending.