Sign users in with a one-time passcode.
Let users sign up and log in by confirming a one-time passcode sent over SMS, WhatsApp, email, or voice instead of creating and remembering a password. Bird Verify eliminates password reset tickets, credential-stuffing attacks, and hashed password storage while letting users switch delivery channels immediately if a code is delayed.
verify.ts
200 · pendingimport { BirdClient } from "@messagebird/sdk"; const bird = new BirdClient({ apiKey: process.env.BIRD_API_KEY!, }); // Send the code, then check it by recipient. await bird.verify.verifications.create({ to: { email: "ada@example.com" }, }).safe(); const { data, error } = await bird.verify.verifications.check({ to: { email: "ada@example.com" }, code: userInput, }).safe(); if (error) throw error;
Your account
Confirm it’s you.
Enter the code sent to
ada@example.com
verify.ts
200 · pendingimport { BirdClient } from "@messagebird/sdk"; const bird = new BirdClient({ apiKey: process.env.BIRD_API_KEY!, }); // Send the code, then check it by recipient. await bird.verify.verifications.create({ to: { email: "ada@example.com" }, }).safe(); const { data, error } = await bird.verify.verifications.check({ to: { email: "ada@example.com" }, code: userInput, }).safe(); if (error) throw error;
Your account
Confirm it’s you.
Enter the code sent to
ada@example.com
verify.ts
200 · pendingimport { BirdClient } from "@messagebird/sdk"; const bird = new BirdClient({ apiKey: process.env.BIRD_API_KEY!, }); // Send the code, then check it by recipient. await bird.verify.verifications.create({ to: { email: "ada@example.com" }, }).safe(); const { data, error } = await bird.verify.verifications.check({ to: { email: "ada@example.com" }, code: userInput, }).safe(); if (error) throw error;
Your account
Confirm it’s you.
Enter the code sent to
ada@example.com
Replace passwords and reset flows without maintaining OTP tables.
Running password-based authentication means storing password hashes, defending login endpoints against leaked credential lists, and troubleshooting forgotten-password emails that land in spam. With the Bird Verify API, your app sends a one-time passcode to the phone number or email address the user enters and checks the submitted digits directly against that recipient. You do not need to store verification IDs between steps or maintain custom retry tables, and the same integration supports two-factor authentication when you want a second check behind a password or sensitive action.
How Bird simplifies passwordless sign-in.
Higher sign-in conversion across channels without password storage, reset tickets, or custom OTP tables.
- 01
Eliminate credential stuffing and password resets.
Users sign in by proving they control their phone number or email address with a short-lived passcode. You remove password hashes from your database, close off credential-stuffing attacks from leaked third-party passwords, and stop losing users in forgotten-password recovery flows.
- 02
Use one verification flow for signup and login.
Send and check a one-time code the same way whether a customer is creating a new account or signing back in. If the verified phone number or email address already belongs to a user, open their session; if it is new, create the account and sign them in on the spot.
- 03
Deliver passcodes over SMS, WhatsApp, email, or voice.
Reach users on the contact address they sign in with, following the channel priority you configure for each country. When a text message is delayed or WhatsApp is unavailable, users can request the code on the next channel immediately without waiting out the resend cooldown.
- 04
Enforce attempt limits and resend caps automatically.
Bird hashes codes at rest, expires pending sessions after a configurable window, locks out brute-force guessing after repeated wrong entries, and caps sends per recipient so bots cannot flood a user's phone or drain your messaging balance.
How passwordless login works
- 01
The user enters their email address or phone number on your sign-in screen.
- 02
Your backend requests a verification, and Bird delivers a one-time passcode over the configured channel for their country.
- 03
The user enters the passcode in your app, or switches to another channel if the first message has not arrived.
- 04
Your backend checks the submitted digits against that recipient and starts the user's session as soon as Bird confirms a match.
Sign users in with two API calls.
Send a one-time passcode when the user submits their email address or phone number, then check the digits they enter against that same recipient. When the code matches, start their session right away; if they mistype a digit or the window expires, the response tells your app why and how many attempts remain.
await bird.verify.verifications.create({
to: { email: input.email },
}).safe();
const { data, error } = await bird.verify.verifications.check({
to: { email: input.email },
code: submitted,
}).safe();
if (error) throw error;
// a true result is the login — no password to compare
if (data.success) grantSession(input.email);
Build it on the Verify platform
Channels, fallback routing, and abuse controls for passwordless authentication.
Scale without
losing control.
Organize teams in workspaces, control API access, and trace changes through audit logs.
Organization
Harbor
Access stays in its workspace.
Production/API keys
Signup service
ActiveAlex Lee
Admin
Today · UTC
Audit log
Organization
Harbor
Access stays in its workspace.
Production/API keys
Signup service
ActiveAlex Lee
Admin
Today · UTC
Audit log
Organization
Harbor
Access stays in its workspace.
Production/API keys
Signup service
ActiveAlex Lee
Admin
Today · UTC
Audit log