Everything between "send a code" and "the user is in".
Tawked is a Saudi OTP verification API: one request sends a code by SMS or WhatsApp to a Saudi mobile number, one request checks it. This page lists what sits behind those two calls, with the real limits.
Two calls, and the lifecycle around them
start and check
POST /v1/verify/start sends the code and returns an id. POST /v1/verify/check verifies what the user typed. That is the whole integration.
Two endpoints
Status, resend, cancel
Read a verification without spending an attempt, send a fresh code on the same id, or cancel it. Resends are capped per verification.
Up to 3 resends
Idempotency and request ids
Send an Idempotency-Key and a retried request returns the original response without sending or charging again. Every response carries an X-Request-Id for support.
Replay-safe
Your own reference
Attach an order id or session id to each verification. It comes back on every read and is searchable in the dashboard.
Up to 64 characters
Channels
SMS under your name
Codes go out through a licensed Saudi gateway under your reviewed sender name, so the recipient sees your brand, not a short code.
STC, Mobily, Zain and MVNOs
WhatsApp verification
A Meta-approved authentication template with a one-tap copy-code button, from a verified business number. Enabled per account on request.
Same two calls
Any Saudi number format
Send 05..., 5..., 9665..., +9665... or 009665...; every form is normalized to E.164 before sending.
5 accepted formats
Arabic or English message
Pick the message language per request. The code itself is digits; the text around it matches the user.
lang field
A sender identity people trust
Reviewed before go-live
Your service name and website are reviewed by a person during business hours before any live message carries them. Protection against impersonation, for you and for recipients.
Manual review
No yearly sender fee
The reviewed sender identity is part of the service. Gateways typically charge a yearly fee per sender name.
Included
Stamped trial messages
Before approval, sandbox messages carry a visible test stamp, so nobody can use the trial to impersonate anyone.
Sandbox only
A sandbox that sends real messages
A test key on day one
A tk_test_ key is issued the moment onboarding completes, before your application is approved. Same endpoints, same shapes as production.
Issued at signup
To your own phone
Sandbox sends deliver real SMS to numbers you have proven you own, so you test the end-to-end flow, not a mock.
10 sends, 3 numbers
Going live is a key swap
Replace tk_test_ with tk_live_ once approved. Nothing else changes.
Zero code changes
Bounded by default
Code shape and expiry
Choose the code length and how long it stays valid, per application, within safe bounds. Codes are stored hashed and cannot be read back.
6 digits (4 to 8), 5 min by default (1 to 15)
Attempts and resends
A code stops working after a few wrong guesses; the outcome is reported once, then the verification is failed.
3 attempts by default (1 to 5)
Per destination
One number cannot be flooded with codes, across all your applications and channels.
5 per hour by default (1 to 10)
Per key and per IP
A fixed per-key request limit, and when you pass the end user's IP, a per-IP send limit too.
120 requests/min, 20 sends/hour per IP
Auto-pause on abuse
A burst of sends to new numbers pauses the application and notifies you, so a leaked form cannot drain your balance overnight.
300 new numbers/hour
Daily spend cap
An optional ceiling on what one application can spend in a day.
Off by default
Keys you can constrain
Expiry and IP allowlist
Give a key an end date, or restrict it to your servers' addresses. Anything else is refused with a clear error.
Per key
Check-only scope
A key for the code-entry path that can verify but never send. Useful for front-line services that should not hold sending power.
scope: check
Hashed at rest
Keys are shown once and stored as a hash; revoke and reissue from the dashboard at any time.
SHA-256
Webhooks and delivery
Signed webhooks
verification.verified, .failed and .expired reach your URL with a timestamp and an HMAC signature, and are retried on failure.
Per application
Autofill-ready messages
The last line of the SMS carries the @domain #code form iOS AutoFill and the WebOTP API read, and the Android app-hash line when you set it.
iOS, Android, web
Delivery receipts
Every send, delivery and failure is logged with its provider status. Failed sends are refunded on the spot.
In the dashboard
Billing you can predict
One price per delivered code
SAR 0.09 per SMS code that is delivered. Not per attempt, not per segment.
SAR 0.09
Failed sends cost nothing
If the network does not deliver, the charge is reversed in the same ledger.
Refunded
Prepaid, no contract
Top up from SAR 25 to SAR 500 by card, spend it at the same rate, no minimum, no subscription. New accounts start with SAR 10 free.
SAR 10 on signup
For platforms and the people who run them
Partner API
Marketplaces and platforms provision an application per merchant, send on their behalf with one key, and read usage per merchant.
/v1/partner
Docs in both languages
The full reference in Arabic and English, an OpenAPI 3.1 description at /openapi.json, and a Markdown version for tools.
OpenAPI 3.1
Engineers answer
Support by email and WhatsApp, answered by the people who built the platform, in Arabic or English.
support@tawked.com
A gateway sells messages. Tawked sells the verification.
Public prices checked on 2026-09-09 on each provider's pricing page. Global providers list US dollar prices before tax; the Saudi gateways list prices including VAT. Sources and the full table are in the comparison post.
| Tawked | Global CPaaS (Twilio, Plivo) | Saudi bulk SMS gateway | |
|---|---|---|---|
| Built for | OTP verification, end to end | Any messaging; you build OTP on top | Campaigns; you build OTP on top |
| Public price per Saudi SMS | SAR 0.09 per delivered code | About SAR 0.73 per segment (USD 0.1949 to STC) | SAR 0.069 to 0.13 per sent message, by volume |
| Charged when | Delivered | Sent | Sent |
| Sender name | Reviewed, included | Register through a local partner | About SAR 230 per year |
| Code generation, expiry, attempts | Built in and bounded | Build it yourself | Build it yourself |
| Real messages before approval | Sandbox to your own phone | Trial to verified numbers | Varies |
| WhatsApp verification | Same API, on request | Separate product | Separate product or none |
| Docs and support in Arabic | Yes, by engineers | English | Arabic |
Questions people ask before switching
How is Tawked different from an SMS gateway?
A gateway sells messages; you build code generation, expiry, attempt counting and abuse limits on top. Tawked sells the verification itself: one call sends the code, one checks it, and everything in between is built, bounded and billed only on delivery.
What does it really cost?
SAR 0.09 per delivered SMS code, from prepaid credit. Failed sends are not charged, there is no yearly sender-name fee and no contract. New accounts get SAR 10 of free credit.
Can I test before my sender name is approved?
Yes. A tk_test_ key is issued the moment onboarding completes and sends real, stamped messages to your own phone with the same requests and responses, up to 10 sends and 3 numbers per application.
Is WhatsApp available?
Yes, for verification codes, through a Meta-approved authentication template with a copy-code button, enabled for your account on request. The channel is a field on verify/start, so you choose SMS or WhatsApp per user.
What if an API key leaks?
Revoke it from the dashboard at once. Before that, constrain it: an expiry date, an IP allowlist, or a check-only scope for a key that never sends. The per-destination, per-IP and daily spend limits bound the damage even while it is in use.
Verify your first user today.
Only two API calls between you and a verified Saudi user.
SAR 10 of free credit. No card required.