Code verification

The telegram_otp, sms, flash_call and max_bot methods follow the same flow: the user receives or reads a short code, enters it in your app, and you confirm the code via the API. Only the delivery channel differs — max_bot has an extra "share number" step in the MAX messenger.

Method	Where the user gets the code
telegram_otp	The code arrives as a Telegram message
sms	The code arrives over SMS
flash_call	A drop-call to the user's number; the code is the last digits of the incoming number
max_bot	The code arrives in the MAX messenger after the user opens the bot via deep_link and shares their number

Step 1. Initiate the verification

Set the method you need (sms, telegram_otp, flash_call or max_bot):

curl -X POST https://api.verificahub.ru/v1/verify \
  -u api_key:api_secret \
  -H "Content-Type: application/json" \
  -d '{
    "phone_number": "+79991234567",
    "method": "sms"
  }'

Response 201 Created:

{
  "request_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "phone_number": "+79991234567",
  "method": "sms",
  "status": "sent",
  "cost": { "amount": 3.0, "currency": "RUB" },
  "expires_at": "2026-06-17T12:35:00Z",
  "code_length": 4
}

code_length — how many digits the code has. Use it to configure the input field.

:::note max_bot For max_bot, the response additionally contains a deep_link field (https://max.ru/<bot>?start=<token>) — show it to the user as a link or a QR code. The code arrives in MAX only after the user opens the bot and shares their number (the same one you're verifying). The method is available if enabled for your account. :::

Step 2. The user enters the code

• Telegram / SMS — the user receives the code in a message and types it in.
• Flash Call — the user gets a short drop-call; the code is the last code_length digits of the calling number. The user types them in (no need to answer).
• MAX — the user opens the MAX bot via the deep_link, taps "Share number", after which the code arrives in MAX and the user types it in.

Step 3. Check the code

Submit the entered code together with the request_id:

curl -X POST https://api.verificahub.ru/v1/verify/check \
  -u api_key:api_secret \
  -H "Content-Type: application/json" \
  -d '{
    "request_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "code": "1234"
  }'

Response 200 OK:

{
  "request_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "status": "verified",
  "phone_number": "+79991234567"
}

status: "verified" means the code is correct and the number is confirmed. If the code is wrong or the session expired, you get 400 — show the user a message and let them request a new code.

note

This flow does not apply to reverse_flash_call — there verification is automatic, with no code entry. See Reverse flash-call.