# Verify a code

```http
POST https://smsprovider-web.vercel.app/api/v1/otp/verify
```

Checks the code the user typed. Each call counts as an attempt; after `max_tries` wrong attempts the code is invalidated.

**Authentication:** `Authorization: Bearer bm_live_…` · **Required scope:** `otp`

## Request body

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `to` | string | yes | len 5–20 |
| `code` | string | yes | pattern `^\d{4,10}$` |
| `app_id` | string | no | pattern `^[A-Za-z0-9_-]{1,32}$` |

## Response

`200` — `OtpVerifyResult`

```json
{
  "verified": true,
  "tries_left": 2,
  "session_id": "c3a1b2d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
}
```

## Errors

| Status | Code |
| --- | --- |
| 400 | `validation_error` |
| 404 | `not_found` |
| 401 | `unauthorized` |
| 403 | `insufficient_scope` |
| 429 | `rate_limited` |
| 500 | `internal_error` |

## Examples

### curl
```bash
curl -X POST "https://smsprovider-web.vercel.app/api/v1/otp/verify" \
  -H "Authorization: Bearer $BATLER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"0501234567","code":"482913","app_id":"login"}'
```
### Node.js
```ts
import { BatlerSMS } from "@batler/sms";

const sms = new BatlerSMS({ apiKey: process.env.BATLER_API_KEY! });
const body = {
  "to": "0501234567",
  "code": "482913",
  "app_id": "login"
};
const result = await sms.otp.verify(body);
```
### PHP
```php
<?php
$ch = curl_init("https://smsprovider-web.vercel.app/api/v1/otp/verify");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer " . getenv("BATLER_API_KEY"),
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode(["to" => "0501234567", "code" => "482913", "app_id" => "login"], JSON_UNESCAPED_UNICODE),
]);
$result = json_decode(curl_exec($ch), true);
```
### Python
```python
import os, uuid, requests

resp = requests.request(
    "POST", "https://smsprovider-web.vercel.app/api/v1/otp/verify",
    headers={"Authorization": f"Bearer {os.environ['BATLER_API_KEY']}"},
    json={"to": "0501234567", "code": "482913", "app_id": "login"},
    timeout=30,
)
resp.raise_for_status()
result = resp.json()
```
### C#
```csharp
using var http = new HttpClient();
http.DefaultRequestHeaders.Authorization = new("Bearer", Environment.GetEnvironmentVariable("BATLER_API_KEY"));
var req = new HttpRequestMessage(HttpMethod.Post, "https://smsprovider-web.vercel.app/api/v1/otp/verify");
req.Content = new StringContent("{\"to\":\"0501234567\",\"code\":\"482913\",\"app_id\":\"login\"}", System.Text.Encoding.UTF8, "application/json");
var res = await http.SendAsync(req);
var result = await res.Content.ReadAsStringAsync();
```