SMS OTP

Both endpoints are real and fully implemented — the call shapes below are accurate and complete. Sending currently fails for a specific, disclosed reason, confirmed live. See SMS OTP for the full explanation — this page covers the raw calls.

Send a code

POST /api/v1/sms/send
Authorization: Bearer <threshold1_jwt>
Content-Type: application/json

{ "phone": "+14155551234" }

Real response, captured live, right now:

{ "success": false, "error": "Failed to send SMS. Please try again.", "code": "SEND_FAILED" }

502

This is not a bug to report — it's the real, current result of the SMS provider (Plivo) account not being funded yet, exactly as SMS OTP describes. The call shape itself is correct; there is nothing wrong with how you'd call this.

Verify a code

POST /api/v1/sms/verify
Authorization: Bearer <threshold1_jwt>
Content-Type: application/json

{ "code": "123456" }

Same response shape as TOTP verify: { "success": true, "enrolled": true } on success, invalid_code on a wrong or reused code. Untestable end-to-end today for the same reason /send fails — there's no way to receive a real code until a real send succeeds.

What's next

SMS OTP (Methods Reference) — the full, confident explanation of what's built vs. what's blocked, and why.
TOTP — the step-up method with no external dependency, available today.