Bank-Grade Email OTP API. Zero Server Cost.
Why pay thousands per month for verification APIs? VerifySecurely allows indie and low-budget developers to link their own Gmail SMTP to dispatch leak-proof, 10-minute 6-digit codes to their users. 100% whitelabel, zero third-party branding.
Zero-Leakage Guarantee
Codes never exposed in HTML or headers
10-Minute Expiry
Automatic TTL session expiration
Real-Time 6-Digit Email Verification
Code is delivered strictly to your inbox. Zero client exposure, zero header leakage, and 100% immune to Burp Suite tampering.
Live Verification Gateway
Strictly 6 Numeric Digits • Zero On-Screen Exposure
Why client tampering cannot bypass authentication:
- Client response tampering (e.g. editing HTTP 200/verified=true in proxy) does NOT generate a signed server session.
- Server issues authentication JWT tokens ONLY when the SHA-256 database hash matches via constant-time comparison.
- All subsequent protected routes strictly verify the cryptographic HMAC signature on the server.
Enterprise Security Without The Enterprise Invoice
Engineered specifically so low-budget developers never have to compromise between safety and cost.
Bring Your Own Mail (BYOM)
Send OTPs directly from your own Gmail. 100% Free & Unlimited verifications with zero subscription fees, zero platform caps, and zero hidden costs.
Zero-Leakage Architecture
The 6-digit OTP code is never returned in client response bodies, headers, or cookies. Even with DevTools open, zero leaks.
10-Minute Auto Expiry
Every verification code has an enforced 10-minute cryptographic TTL. Stale or delayed codes are automatically rejected.
Anti-Brute-Force Guard
Attempts are strictly throttled. If an attacker guesses incorrectly 5 times, the session is invalidated and purged.
AES-256-GCM Vault
Developer Gmail App Passwords are encrypted at rest using military-grade AES-256-GCM authenticated cipher.
3-Minute Drop-in Setup
Clean REST endpoints. Integrate with two simple POST requests in Next.js, Express, Django, Laravel, or raw cURL.
How The Verification Pipeline Works
A secure backend-to-backend pipeline that leaves zero room for interception or client-side tampering.
User requests verification
User inputs their email on your website or mobile app and clicks 'Send Code'.
API Call to VerifySecurely
Your backend calls POST /api/v1/otp/send with your secret API key.
Secure Vault & Dynamic SMTP
VerifySecurely generates a 6-digit numeric OTP, hashes it with SHA-256, and dispatches via your Gmail SMTP.
Delivered to User's Inbox
User receives a branded, clean email with their 10-minute valid OTP. Zero HTML header leakage.
Server-side Validation
User enters the code; your backend verifies via POST /api/v1/otp/verify. Verified in 20ms.
100% Anti-Tamper & Anti-Leak Guarantee
The OTP is NEVER stored as plain text, NEVER returned to the client browser in response headers, and CANNOT be extracted via client inspection or proxy tools.
Plug Into Any Backend in Under 3 Minutes
Works with any frontend or backend language. Configured for verifysecurely.bond.
// 1. Send OTP to User's Email (Supports personalized first name greeting)
async function sendVerificationOtp(userEmail, userName = "Alex") {
const response = await fetch("https://verifysecurely.bond/api/v1/otp/send", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-api-key": "vsec_live_your_api_key_here",
},
body: JSON.stringify({ email: userEmail, name: userName }),
});
const data = await response.json();
if (data.success) {
console.log("6-Digit OTP sent successfully! Valid for 10 minutes.");
}
}
// 2. Verify OTP entered by User
async function verifyUserOtp(userEmail, enteredOtp) {
const response = await fetch("https://verifysecurely.bond/api/v1/otp/verify", {
method: "POST",
headers: {
"Content-Type": "application/json",
"x-api-key": "vsec_live_your_api_key_here",
},
body: JSON.stringify({
email: userEmail,
otp: enteredOtp, // e.g. "792418"
}),
});
const result = await response.json();
if (result.verified) {
console.log("Email successfully verified server-side!");
} else {
console.error("Verification failed:", result.error);
}
}