The code is a secret. We treat it like one.

A one-time code is only as good as the way it's generated, stored, and rate-limited. Bird Verify generates codes with a cryptographic source, stores only a hash, compares in constant time, and caps both sends and guesses, so a leaked log or a brute-force loop gets an attacker nowhere. Fraud scoring builds on this base next.

Get StartedContact Sales
verify.ts
200 · pending
import { BirdClient } from "@messagebird/sdk";

const bird = new BirdClient({
  apiKey: process.env.BIRD_API_KEY!,
});

// Send the code, then check it by recipient.
await bird.verify.verifications.create({
  to: { phone_number: "+15551234567" },
}).safe();

const { data, error } = await bird.verify.verifications.check({
  to:   { phone_number: "+15551234567" },
  code: userInput,
}).safe();
if (error) throw error;
Verification flow

Your account

Confirm it’s you.

Enter the code sent to

+1 ••• ••• 4567

Example verification code

482691
Code verified
Send a code. Confirm the recipient.

Security that's on by default, not an add-on.

Every verification on the Bird Verify API carries the same protections: the code is generated server-side, never returned, and stored only as a hash; checks run in constant time and against a bounded attempt budget; and sends are capped per recipient and per workspace. You don't opt in or wire these up: they're how the API behaves, whether you run it as two-factor login or passwordless sign-in.

Five protections on every verification.

No setup step, no add-on SKU.

  1. 01

    Cryptographic generation.

    Codes are drawn from a cryptographic random source, uniform across the code space, not a predictable counter or timestamp.

  2. 02

    Hashed at rest, never on the wire out.

    Only an HMAC-SHA256 of each code is stored; the plaintext is never returned by the API and never written to your stack or our logs.

  3. 03

    Constant-time comparison.

    Submitted codes are compared in constant time, so an attacker learns nothing from how long a check takes.

  4. 04

    Attempt lockout.

    Each session has a bounded number of checks (5 by default). Once they're spent the session fails, so guessing can't run forever.

  5. 05

    Send caps.

    A per-recipient send cap and a resend cooldown bound the spend and the abuse surface, each a 429 with Retry-After.

Guessing runs out before your users do.

A wrong code comes back with the attempts remaining, and the session fails once the budget is spent, so a brute-force loop hits a wall long before it finds the code.

lockout.ts
200
const { data, error } = await bird.verify.verifications.check({
  to:   { phone_number: "+15551234567" },
  code: guess,
}).safe();
if (error) throw error;

// wrong code, attempts left → { success: false, reason: "incorrect_code", attempts_remaining: 2 }
// budget spent, session done → { success: false, reason: "attempts_exhausted", attempts_remaining: null }
Coming next

Coming next: fraud signals and SMS-pumping protection.

The per-send history Verify records today is the groundwork for a fraud layer we're building now. It rides the same create and check calls, so adopting it later is a config change, not a re-integration.

Risk signals on create. Pass device, IP, and request context on a verification, and high-risk attempts get a blocked outcome before a code is ever sent, so you're not paying to message an attacker.

SMS-pumping and AIT protection. Per-country and per-prefix send caps plus a per-workspace spend ceiling shut down the artificially-inflated-traffic attack that drives OTPs to premium number ranges for carrier revenue share.

Built on what's already there. Risk decisioning reads the attempt history Verify keeps from day one, and the blocked outcome is already part of the status model, so the fraud layer lands without reshaping your integration.

The rest of the Verify platform

One API, one set of keys. Explore the other capabilities.

SMS OTPOne-time passcodes over SMS, with global reach and built-in rate limits.Email OTPVerify by email on the network that already carries your transactional mail.WhatsApp OTPCodes on WhatsApp as an orderable channel in the same plan.Voice OTPRolling out: a spoken code for landlines and hard-to-reach users.Channel orchestrationPer-country channel order and senders, resolved automatically and tunable per request.Verify API overviewThe full Verify API: create-or-retry, check by target, and advance to the next channel.

Scale without
losing control.

Organize teams in workspaces, control API access, and trace changes through audit logs.

BirdHarborOrganization
WorkspacesProductionSandbox

Delivery agent

API key · Customer operations team
Active
PermissionsAccess
EmailRead & write
SMSRead & write
ALAlex Lee AdminPermissions updated

Audit log

Production
Workspace
Production
Resource
Delivery agent
WhatsApp
Read accessRead & write
Succeeded
WorkspacesTeam rolesAPI authentication
Explore Enterprise

Start with Verify.
Build across channels with Bird.

Get StartedContact Sales

Your next idea. Ready to connect.

Get StartedContact Sales