SMS OTP API for Saudi numbers
Tawked Verify is an OTP verification API for Saudi numbers. Send and verify an SMS OTP code in two API calls for sign-up or login in your application.
0.09 SAR per code sent, from prepaid credit. Every account starts with 10 SAR free credit. No card required.
From your server over the API, with Supabase and WooCommerce, and for platforms through the Partner API.
Your Noor Store verification code is: 482913 via Tawked
nowOne verification
POST /v1/verify/start201pending- The SMS network accepted the codesent0.09 SAR
POST /v1/verify/check200verified
Two calls, with the rest built in
POST /v1/verify/start sends the code and returns an id. POST /v1/verify/check verifies what the user typed.
1Send the codePOST /v1/verify/start
curl -X POST https://tawked.com/v1/verify/start \
-H "Authorization: Bearer tk_live_…" \
-H "Content-Type: application/json" \
-d '{
"to": "0551234567",
"channel": "sms",
"lang": "ar"
}'const res = await fetch("https://tawked.com/v1/verify/start", {
method: "POST",
headers: {
Authorization: "Bearer tk_live_…",
"Content-Type": "application/json",
},
body: JSON.stringify({ to: "0551234567", channel: "sms", lang: "ar" }),
});
const data = await res.json();import requests
res = requests.post(
"https://tawked.com/v1/verify/start",
headers={"Authorization": "Bearer tk_live_…"},
json={"to": "0551234567", "channel": "sms", "lang": "ar"},
)
data = res.json()2Check what the user typedPOST /v1/verify/check
{ "id": "b7e5c2b0…", "code": "482913" }201Response
{
"id": "b7e5c2b0…",
"status": "pending",
"expires_at": "2026-10-08T07:25:00.000Z"
}Text message, from Tawked's sender ID
Your Noor Store verification code is: 482913 via Tawked
200Response
{"verified": true, "status": "verified"}"to"Send 05..., 5..., 9665..., +9665... or 009665...; every form is normalized to E.164 before sending.
"lang"Arabic or English message: Arabic by default, English when you send "lang": "en".
resendStatus, resend, cancel on the same id: read the status without spending an attempt, resend up to 3 times, cancel at any time.
Idempotency-KeyRepeat a request with the same Idempotency-Key and the first response comes back, with no second send or charge. Every response carries an X-Request-Id, and each verification takes your own reference of up to 64 characters.
Your app's name, in the message
No sender ID to register
Tawked Verify sends every code from Tawked's sender ID, so you apply for no sender ID and pay no fee for one.
Your app's name, after review
A person reviews your application name and website during business hours, before the name appears in any live message. Renaming the app sends it back to review.
Ready for autofill
The last line can carry the
@domain #codeform iOS AutoFill and the WebOTP API read, with the Android app-hash line before it. Both lines are optional.
Limits that protect your balance
Defaults work from the first call. Change them per application, within their range.
| Limit | Default | Range |
|---|---|---|
| Length | 6 | 4 to 8 |
| Expiry in minutes | 5 | 1 to 15 |
| Attempts | 3 | 1 to 5 |
| Per number an hour | 5 | 1 to 10 |
Per IP an hourwhen you pass client_ip | 20 | 1 to 1,000 |
| Per key a minute | 120 | Fixed |
A cap per number
One number cannot be flooded with codes, across all your applications and channels.
Auto-pause on abuse
When an application sends to 300 new numbers or more in an hour, it pauses itself and tells you, so nobody can drain your balance overnight through an exposed sign-up form.
Daily spend cap
An optional ceiling on what one application spends in a day. It is off until you set it.
Keys you can constrain
Give a key an expiry date, an IP allowlist, or the check-only scope
verify:check, which verifies but never sends. Keys are stored as SHA-256 hashes and codes are stored hashed, so neither can be read back.
One price per code sent
0.09 SAR a code, whatever the message length; the user's check attempts cost nothing.
Free credit
10SAR
On signup, enough for 111 codes.
Top up by card from 25 to 50,000 SAR.
Full pricingWhat comes off your balance
- An SMS code sent
- 0.09 SAR
- Charged when the SMS network accepts it
- A resend
- Same price
- A new code on the same id, up to 3 times
- A code never entered
- Charged
- The network accepted it, so it stays charged
- A send that never left
- Refunded at once
- Refused by the network, or failed before reaching it
No subscription or contract
From your server, or the platform you build on
REST API
Call it from any backend;
Quickstartverification.verified,verification.failedandverification.expiredreach your URL with an HMAC signature. The OpenAPI 3.1 description is at/openapi.json.Supabase
Using Supabase Auth? Its phone sign-in codes can go through Tawked Verify. Connect it from the console as Supabase's Send SMS hook, with no change to your app's code.
See the setupWooCommerce
The Tawked plugin adds phone sign-in and a code before cash on delivery to a WooCommerce store. It is free, and it sends order updates on WhatsApp through Tawked Notifications.
See the pluginPartner API
Platforms provision an application per client through
Partner docs/v1/partner, send on its behalf with one key, and read each client's usage.AI assistants
Connect your AI assistant to Tawked's MCP server at
Detailstawked.com/mcpby signing in, and it can send a test code to the account owner's phone and check it.
A gateway sells messages. Tawked sells the verification.
Public prices from each provider's pricing page on 2026-10-08. Twilio lists USD before tax; the Saudi gateways include VAT.
| Item | Tawked Verify | Global CPaaS:Twilio Verify | Saudi bulk SMS gateway:Taqnyat, 4jawaly |
|---|---|---|---|
| Built for | OTP verification, end to end | Any messaging, with Verify on top | Campaigns and bulk SMS; you build OTP on top |
| Public price for one Saudi code | 0.09 SAR per code sent | 0.05 USD per successful verification plus 0.1949 USD per SMS segment, about 0.92 SAR | 0.063 to 0.14 SAR per SMS, by volume |
| Charged when | The network accepts the send; a refused send is refunded at once | Each SMS segment sent, plus the fee on success | Each SMS sent, from a prepaid bundle |
| Sender name | Tawked's, nothing to register | Not registered for a domestic Saudi brand, per Twilio's guidelines | About 230 SAR per year at 4jawaly; your own name, with a CR and a Chamber of Commerce letter |
| Expiry, attempts, limits | Built in, two calls | Built in | You build them |
| Real messages before approval | A test key that sends to your own phone | A trial account | After the sender name is approved |
| Arabic docs and support | Yes | No | Yes |
Tawked Verify guides
- SMS API for Saudi Arabia: The two calls, their answers and the errors
- SMS verification codes, no sender ID to register: Why codes need no sender ID of your own
- Phone verification API: Confirm a user controls a Saudi number, and passwordless login
- WhatsApp OTP API for Saudi Arabia: Verification codes over WhatsApp, with the same two calls
- SMS OTP providers in Saudi Arabia 2026: The dated price comparison, with sources
- SMS or WhatsApp OTP in Saudi Arabia: Choosing the channel for your codes
- SMS sender ID registration in Saudi Arabia: The full guide: the rules, the cost and when you need one
Questions people ask before switching
What is Tawked Verify?
Tawked Verify is an OTP verification API for Saudi numbers. One call sends a one-time code by SMS to a Saudi mobile number, and a second call checks it. Use it for sign-up, login and two-step verification, at 0.09 SAR per SMS code sent, from prepaid credit.
What does it really cost?
Tawked Verify costs 0.09 SAR per SMS code sent, from prepaid credit, with no plan or contract. A code is charged when the SMS network accepts it, whether or not the user types it, and a resend is a new code at the same price. A send the network refuses, or that fails before it leaves, is refunded to your balance at once. New accounts start with 10 SAR of free credit.
Do I need to register a sender ID in Saudi Arabia?
No. Tawked Verify sends your codes from Tawked's sender ID, the same for every customer, and the text of every message names your reviewed app, for example "Your Noor Store verification code is: 482913". You register no sender ID and pay no fee for one.
How is Tawked Verify different from an SMS gateway?
A gateway sells messages; you build code generation, expiry, attempt counting and abuse limits on top. Tawked Verify sells the verification itself: one call sends the code, one checks it, everything in between is built and bounded, and a send the network refuses costs you nothing.
Which numbers can receive the codes?
Tawked Verify sends codes to Saudi mobile numbers only. A number is accepted in any of five forms, 05…, 5…, 9665…, +9665… or 009665…, in Western (123) or Arabic-Indic (١٢٣) digits, and is normalized to +9665… before sending. Any other number answers invalid_destination.
Can I test before my app name is approved?
Yes. Create a tk_test_ key on your application's API keys page before approval. It sends real, stamped messages to the phone you signed up with, and only to it, with the same requests and responses, up to 10 sends per application, each charged from your balance like any code.
What if a code does not arrive?
Tawked Verify sends a fresh code on the same id when you ask for a resend, up to 3 times per verification, charged like any send. The status call reads where the verification stands without using an attempt. If a send is refused or fails, it is refunded at once, the verification is marked failed and a verification.failed webhook goes out. A code the network accepted stays charged even if it never reaches the phone. The status page shows whether SMS sending works right now, measured from live traffic.
Does it work with Supabase phone sign-in?
Yes: Tawked Verify works as Supabase Auth's Send SMS hook. Supabase still makes and checks the code, and Tawked Verify sends it by SMS, naming your approved app, to any Saudi mobile number. signInWithOtp and verifyOtp stay as they are in your code.
Is there a WooCommerce plugin?
Yes: the Tawked plugin for WooCommerce is free. It lets customers sign in with a code sent to their phone, asks for a code before cash on delivery, and sends order updates on WhatsApp from your store's number through Tawked Notifications. Codes cost the same as any Tawked Verify code.
Is WhatsApp available?
Not yet. Verification codes over WhatsApp are coming for every account at once, with the same two calls: a Meta-approved authentication template with a copy-code button, sent from Tawked's verified business number. SMS works today. WhatsApp notifications to your customers are a different product: Tawked Notifications.
What if an API key leaks?
Revoke it from the dashboard at once. Before that, constrain it: an expiry date, an IP allowlist, or a check-only scope for a key that never sends. The per-destination, per-IP and daily spend limits bound the damage even while it is in use.
When is Tawked Verify the wrong choice?
Tawked Verify is the wrong choice when you send to numbers outside Saudi Arabia, need SMS marketing campaigns, need messages to come from your own company's sender ID, or want codes by email.
Can an AI assistant use Tawked Verify?
Yes. Tawked's MCP server at tawked.com/mcp lets an AI assistant you connect to your application send a test code to the account owner's phone, check it, and read your verifications and usage. The assistant connects once you sign in to your account, and each code is charged from your balance like any other.
Send your first code today
Sign up with your mobile number
Your account starts with 10 SAR of free credit.
Test with a
tk_test_keyCreate it on the API keys page before approval. It sends real SMS with a visible test stamp to the phone you signed up with, and only to it, up to 10 sends per application.
Swap in
tk_live_once approvedNothing else changes.