Skip to main content
POST
Verify the phone code

Notes

  • phone_number is required when the user had no phone on file at start (e.g. a fresh connection before KYC) — the code was sent to the number you supplied, can only be checked against it, and there’s no stored number to fall back on, so a call without it returns phone_number_required. Keep passing that same number on verify until the user is verified: the code is only ever valid against the number it was sent to, so don’t switch to a stored number that shows up mid-flight (a KYC backfill between start and verify). Omit phone_number only when start sent the code to a number already on file. It’s optional in the schema only because that stored-number case exists.
  • On verified, the user can fund immediately — the verification stays fresh for 60 days.
  • invalid_code carries a reason (incorrect, expired, too_many_attempts, or no_code) so you can decide between “try again” and “send a new code”.

Authorizations

Authorization
string
header
required

A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.

Body

application/json
user_id
string
required
code
string
required
phone_number
string

Required only when the code was sent to a number you provided.

Response

Verified.

object
string
Allowed value: "phone_verification"
status
enum<string>
Available options:
sent,
already_verified,
verified
channel
enum<string>

Where the code was sent (status sent only).

Available options:
sms,
email
phone
string

The masked destination number (status sent only).

expires_in_seconds
integer

How long the code stays valid (status sent only).