Base URL and authentication
Base URL: https://app.autochatly.com/api/verify/v1. Send your API key in the header Authorization: Bearer acv_live_... and use Content-Type: application/json. Call the API only from your server; never put the key in a website, mobile app or public repository. Machine-readable spec: OpenAPI 3 JSON.
POST /send
Sends a 6-digit code to the user on WhatsApp from your connected WhatsApp Business number.
| Field | Type | Description |
|---|---|---|
phone | string, required | International format, e.g. +919876543210. A 10-digit Indian mobile is treated as +91. |
curl -X POST https://app.autochatly.com/api/verify/v1/send \
-H "Authorization: Bearer $AUTOCHATLY_OTP_KEY" -H "Content-Type: application/json" \
-d '{"phone":"+919876543210"}'
{"ok":true,"request_id":"6f1c2b7e-3a9d-4c1e-9b8a-2f4d5e6a7b8c","expires_in":300,"channel":"whatsapp"}Store request_id with the user's session. The code itself is never returned to you.
POST /check
| Field | Type | Description |
|---|---|---|
request_id | uuid, required | Value returned by /send. |
code | string, required | The 6 digits the user typed. |
curl -X POST https://app.autochatly.com/api/verify/v1/check \
-H "Authorization: Bearer $AUTOCHATLY_OTP_KEY" -H "Content-Type: application/json" \
-d '{"request_id":"6f1c2b7e-3a9d-4c1e-9b8a-2f4d5e6a7b8c","code":"123456"}'
{"ok":true,"verified":true,"phone":"+919876543210"}Only trust "verified": true from this call. Then log the user in or mark the number as verified.
Errors
Every error returns {"ok": false, "error": "code", "message": "..."}. The message is written for end users and safe to display.
| HTTP | error | Meaning |
|---|---|---|
| 401 | unauthorized | Missing, wrong, revoked or IP-restricted key. |
| 422 | invalid_phone / wrong_code | Bad number format, or wrong code (attempts_left included). |
| 422 | country_not_allowed | Country not enabled (India +91 by default). |
| 429 | too_soon / phone_limit / ip_limit / app_limit / too_many_requests | Rate limit reached. Retry later. |
| 404 | not_found | Unknown request_id for this key. |
| 409 | already_used | Code was already verified. |
| 410 | expired / blocked | Code expired, or locked after 5 wrong attempts. Send a new one. |
| 502 | send_failed | WhatsApp could not deliver (e.g. number not on WhatsApp). Fall back to SMS or email. |
| 503 | not_configured | Your WhatsApp number is not connected. |
Limits
- Code: 6 digits, valid 5 minutes, single use, 5 attempts.
- Per phone number (per business): one code every 30 seconds, 3 per 10 minutes, 10 per day.
- Per API key: 30 sends per minute and 5,000 per day by default (ask support to raise).
- Per IP: 120 requests per minute; repeated invalid keys lock the IP for 10 minutes.
Security
- Codes are generated with a cryptographically secure random generator and stored only as an HMAC hash. They never appear in logs or API responses.
- API keys are stored hashed, shown once, can be locked to server IPs and revoked instantly.
- Request IDs are random UUIDs and only work with the key that created them.
- A country allow-list blocks OTP-pumping fraud. All traffic is HTTPS.
- End-user phone numbers are used only to deliver and verify codes for your business.
Best practices
- Keep the key in an environment variable on your server.
- Rate-limit your own "send code" button per user and add a CAPTCHA on public signup forms.
- Show the
messagefrom error responses to users; it is already friendly. - Offer SMS or email as a fallback when you get
send_failed.