---
title: "Send OTP verification code"
method: POST
path: "/verify/send"
tags: ["Phone Verification (OTP)"]
---

# Send OTP verification code

`POST /verify/send`

## Request

- Base URL: `https://api.envoisms.ma/v1`
- URL: `https://api.envoisms.ma/v1/verify/send`
- Auth: HTTP bearer

## Request body

- VerifySendRequest
  - `to` string, required: Recipient phone number in international E.164 format (e.g. +212612345678, +33612345678). International destinations are fully supported via the whatsapp channel when configured on a Verify App with allowed_countries.
  - `channel` 'sms' | 'whatsapp' | 'telegram' | 'voice' | 'rcs': whatsapp = EnvoiSMS generates a 6-digit code and delivers it with its own WhatsApp authentication template, nothing to store on your side. Supports domestic (Morocco) and international delivery. The code is valid for expiry seconds, capped at 600 (10 minutes, also the default). If WhatsApp refuses the submission, the code is sent by SMS instead; an SMS follow-up after a delay happens only with a Verify application (app_id) whose channel list includes sms with auto-cascade on. code_length and template are ignored in this mode. sms = classic mode: you control code length, expiry, template and sender. Both modes are confirmed with the same /verify/check call.
  - `otp_type` 'copy_code' | 'one_tap' | 'zero_tap' | 'url': WhatsApp Authentication template button type (copy_code, one_tap autofill, zero_tap, or url).
  - `package_name` string: Android application package name for One-Tap / Zero-Tap Autofill
  - `signature_hash` string: Android app signature hash (SMS Retriever / Autofill API)
  - `code_length` integer: sms channel only — whatsapp verifications always use 6 digits
  - `expiry` integer: Code validity in seconds, 60–1800 (default 600). On the whatsapp channel it is capped at 600, the authentication template's own limit.
  - `app_id` string: Verify Application ID configured in dashboard or via /v1/verify/apps. Enforces channel cascade and security policies (allowed_countries geofencing). Direct /verify/send calls without an app_id are restricted to Morocco (["MA"]) by default to protect against toll fraud.
  - `cascade` string[]: Ordered channel cascade list for validation routing (e.g. ['whatsapp', 'sms', 'voice']). ignored if app_id is set.
  - `brand` string: Brand name shown in OTP message
  - `template` string: Custom OTP message. Use {{code}} and {{brand}} placeholders.
  - `otp_button_text` string: Custom label for the WhatsApp click-to-copy OTP button
  - `web_otp_domain` string: Target domain for W3C WebOTP browser autofill (appends @domain #code to the SMS)
  - `app_hash` string: 11-character Android SMS Retriever API application hash for automatic Android OTP detection

## Response `202`

OTP sent

- object
  - `session_id` string
  - `message_id` string: Underlying message id (sms channel only)
  - `to` string
  - `channel` string
  - `expires_at` string, date-time
  - `status` string
  - `cost` object: Managed whatsapp verifications only — the flat per-verification price
    - `eur` number
    - `mad` number
  - `sandbox` boolean: Present and true on env_test_ keys; nothing was delivered
  - `sandbox_code` string: Sandbox keys only — the generated code, returned so the check endpoint can be exercised in tests. Never present on a live key.

---

[API](https://skmtc.dev/envoisms/apis/envoisms-ma-api.md) · [All operations](https://skmtc.dev/envoisms/apis/envoisms-ma-api/llms.txt) · [OpenAPI document](https://skmtc.dev/envoisms/apis/envoisms-ma-api/revisions/662db074bd86?raw)