One-time passcodes
Deliver OTP over push (FCM), SMS, email or WhatsApp with per-service templates, quotas and resend cooldowns.
One API to verify your users — OTP over push, SMS, email & WhatsApp, plus TOTP, passkeys, magic links and a full OIDC provider. Authentic · valid · verified.
Built for production from day one
Pick the methods your product needs and turn them on per service. No vendor lock-in to a single channel.
Deliver OTP over push (FCM), SMS, email or WhatsApp with per-service templates, quotas and resend cooldowns.
RFC 6238 authenticator enrolment, server- or user-issued secrets, single-use backup codes and lockout protection.
FIDO2 passkeys through a hosted ceremony page — no passwords, phishing-resistant, with named credentials.
One-click email/phone passwordless links and approve-or-deny push prompts signed on the user's device.
Be the identity provider: authorization code + PKCE + refresh rotation, hosted login & consent, JWKS rotation.
Velocity, impossible-travel, new-country and device-trust signals score every request and can step up or block.
Register a service, drop in your scoped API key, and start verifying. Test everything in sandbox first.
Create a service in the client portal and mint scoped sk_live / sk_test keys with per-key rate limits and IP allowlists.
Use the Python, Node or PHP SDK — or plain REST — to send and verify. Sandbox keys simulate delivery with no quota cost.
Receive an instant verify result plus signed webhooks for otp.verified, auth_request.resolved and more.
Ship in an afternoon. Official, MIT-licensed SDKs mirror the same surface across languages, signed webhooks keep your backend in sync, and sandbox keys let you build the whole flow before a single real message is sent.
One method surface, idiomatic in each language, with typed errors and retry hints.
Verify X-Webhook-Signature: v1=… with the helper shipped in every SDK.
Grant a key only the scopes it needs; cap throughput per key across all workers.
Verification is critical infrastructure. Saheeh Verify is engineered and documented to be operated safely.
TOTP secrets are AES-encrypted; secrets never live in source control.
Per-user export and hard-delete endpoints, scoped to your service and audit-logged.
A documented control set with an ISO 27001 Statement of Applicability and SOC 2 mapping.
Redis-backed limits with non-forgeable client-IP resolution behind the edge proxy.
OIDC refresh rotation with family-reuse detection that revokes a compromised chain.
Every sensitive action is recorded, with Prometheus metrics and OpenTelemetry tracing.
Saheeh Verify maps to ISO 27001, SOC 2 and PCI control sets. Formal certification is on our roadmap — current status is shared with enterprise customers under NDA.
Start free in sandbox, pay as your verification volume grows. Every plan includes all authentication methods.
For building and testing in sandbox.
sk_test keysFor shipping products to real users.
For higher throughput and SLAs.
For regulated & high-scale deployments.
Pricing scales with monthly verifications. See the client portal for current rates in your region.
Create a service, grab your sandbox keys, and send your first verification today — no card required.