Authenticate server-to-server requests safely.
phoneveriflo uses cryptographically secure Bearer tokens with granular scope control, origin validation, and instant zero-downtime key rotation.
# Pass your API key in the standard Authorization Bearer header
curl https://api.phoneveriflo.com/api/v1/jobs \
-H "Authorization: Bearer pv_live_9f82c418ab402e88a75e2b01c4" \
-H "Content-Type: application/json"All requests require Bearer authorization with high-entropy secret tokens.
Bearer pv_live_...→Prevent duplicate jobs and safe automatic retries using 24h unique keys.
Idempotency-Key: uuid→Predictable Token Bucket model at 100 req/s with standard Retry-After headers.
100 req/s burst→Strict date-based compatibility guarantees with 12-month deprecation windows.
v1 (2026-08-11)→Test API Requests in Real Time
Build and simulate verification requests directly in your browser. Generates live code snippets and previews the exact response schema.
Configure request parameters and click Send Request to preview live execution.
The Authorization Header Contract
RFC 6750All API requests must be authenticated using the standard HTTP Authorization header.
Send your secret API key as a Bearer token in the Authorization request header:
Authorization: Bearer pv_live_...
- Requests without an Authorization header will fail with 401 Unauthorized and code UNAUTHORIZED.
- Keys with invalid prefixes or incorrect HMAC checksums will fail with 403 Forbidden and code FORBIDDEN.
- Always use HTTPS. Unencrypted HTTP requests are permanently rejected and never processed.
API Key Formats and Prefixes
High-EntropyUnderstanding the structure of phoneveriflo keys.
phoneveriflo API keys are 64-character high-entropy alphanumeric strings generated using CSPRNG. Only a SHA-256 HMAC hash is stored in our database; the raw token is never recoverable.
- pv_live_...: Production live keys. Charges ledger balance in integer micros and triggers real verification checks.
- pv_test_...: Sandbox keys for staging and automated integration testing without ledger deductions.
| Prefix | Environment | Financial Impact | Scope |
|---|---|---|---|
| pv_live_ | Production | Deducts live integer USD micros | Full production services according to enabled scopes |
| pv_test_ | Development / CI | Zero financial charge (Simulated output) | Mock verification runs for CI/CD test pipelines |
Granular Scopes & Principle of Least Privilege
RBACRestrict key authority to specific actions.
When creating an API key in the Developer Center (/app/developers), assign only the minimum necessary scopes for the application:
- jobs:write: Required to submit new verification jobs (POST /api/v1/jobs) and cancel pending jobs.
- jobs:read: Required to inspect job status (GET /api/v1/jobs/{id}) and download results (GET /api/v1/jobs/{id}/results).
- wallet:read: Inspect organization balance, currency tier, and quota status.
- webhooks:manage: Create, update, or test webhook destination endpoints.
Common Integration Questions
Can I restrict API keys by IP address?
Yes. In the Developer Center key settings, you can define an optional list of allowed IPv4/IPv6 CIDR blocks. Requests originating from unlisted IPs will be rejected with 403 Forbidden.
Related Guides & API References
Ready to build with phoneveriflo?
Generate your secret API key in 30 seconds. Test preflight quotes and receive provider-neutral results with full freshness auditability.