Quickstart

1. Provision the organization and key

Create and verify your account, complete organization onboarding and choose a project. An authorized organization user creates an independent service key for its Sandbox environment with verify:send, verify:check and usage:read. Save the key immediately; keep the project and environment UUIDs with your server configuration. Key provisioning uses the authenticated management APIs until the corresponding connected Developer Console screens are available. An organization administrator can provision these using the internal operating guide. This quickstart does not pretend demo key-management screens issue real credentials.

2. Send a simulated code

The Sandbox uses 123456, performs no Meta call and does not debit your wallet. Use a test phone number you control. purpose is a lowercase application-defined identifier, such as login or password-reset; consentReference is an opaque reference to the user’s request, not a password or OTP.

export SENDLYY_BASE_URL='https://api.sendlyy.app/api/v1'
export SENDLYY_API_KEY='<your-sandbox-service-key>'
export SENDLYY_PROJECT_ID='<project-uuid>'
export SENDLYY_ENVIRONMENT_ID='<sandbox-environment-uuid>'

curl --fail-with-body "$SENDLYY_BASE_URL/verify/verifications" \
  -H "Authorization: Bearer $SENDLYY_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: quickstart-login-001' \
  --data "{\"projectId\":\"$SENDLYY_PROJECT_ID\",\"environmentId\":\"$SENDLYY_ENVIRONMENT_ID\",\"recipient\":\"+2348031234568\",\"purpose\":\"login\",\"consentReference\":\"test-request-001\"}"

A successful response is HTTP 202:

{
  "message": "Verification durably accepted. Sandbox sends are simulated.",
  "data": {
    "id": "11111111-1111-1111-1111-111111111111",
    "messageId": "22222222-2222-2222-2222-222222222222",
    "status": "Pending",
    "expiresAt": "2026-10-27T12:05:00+00:00",
    "deliveryStatus": "Simulated",
    "amount": 0
  }
}

IDs and dates above are illustrative. Save the actual data.id server-side against your user’s login attempt. Never accept an arbitrary verification ID supplied by a browser as proof of that user’s phone number or purpose.

3. Check the code from your server

curl --fail-with-body "$SENDLYY_BASE_URL/verify/verifications/<verification-id>/check" \
  -H "Authorization: Bearer $SENDLYY_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"code":"123456"}'

const response = await fetch(
  `${process.env.SENDLYY_BASE_URL}/verify/verifications/${verificationId}/check`,
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.SENDLYY_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ code: '123456' }),
  },
);
const result = await response.json();
if (!response.ok) throw new Error(result.message);
if (result.data.verified) {
  // Complete only the login attempt bound to verificationId on your server.
}

import os
import requests

response = requests.post(
    f"{os.environ['SENDLYY_BASE_URL']}/verify/verifications/{verification_id}/check",
    headers={"Authorization": f"Bearer {os.environ['SENDLYY_API_KEY']}"},
    json={"code": "123456"},
    timeout=20,
)
response.raise_for_status()
result = response.json()
if result["data"]["verified"]:
    pass  # Complete the server-bound login attempt once.

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

using var client = new HttpClient { Timeout = TimeSpan.FromSeconds(20) };
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Bearer", Environment.GetEnvironmentVariable("SENDLYY_API_KEY"));
var url = $"{Environment.GetEnvironmentVariable("SENDLYY_BASE_URL")}/verify/verifications/{verificationId}/check";
using var response = await client.PostAsJsonAsync(url, new { code = "123456" });
response.EnsureSuccessStatusCode();
using var result = await JsonDocument.ParseAsync(await response.Content.ReadAsStreamAsync());
bool verified = result.RootElement.GetProperty("data").GetProperty("verified").GetBoolean();

verified: true is returned only for the successful transition. Rechecking a consumed code returns verified: false, even if its stored status is Verified. Your application must also make its own login/session creation single-use.

4. Prepare for Live

Read authentication, Verify limits, billing and availability. Fund the organization wallet, use a separate Live key/environment, obtain any required service approval and configure signed webhooks. Never replace staging evidence with a Sandbox result.

Start

Build

1. Provision the organization and key

2. Send a simulated code

3. Check the code from your server

4. Prepare for Live

​1. Provision the organization and key

​2. Send a simulated code

​3. Check the code from your server

​4. Prepare for Live

1. Provision the organization and key

2. Send a simulated code

3. Check the code from your server

4. Prepare for Live