WATAD Verify / Developers

Add phone checks in minutes.

One request starts a check, one press in Telegram proves the number, and a signed answer reaches your server. This guide has everything you need, in five languages.

Base URL https://watadnexus.com/api/verify/v1

Quick start

  • Get a key Make an app in the console, and copy the secret key and the webhook secret. They are shown once.
  • Start a check When the person types their number, send it from your server, take the check’s link and send them there.
  • Receive the result They press “Share my number” in Telegram, and a signed webhook reaches your server with verified or mismatch.

Here is the whole integration in one file, in your language:

Keys

Every API request carries your app’s secret key in the Authorization header. The key starts with wvk_ and stays on your server only, never in a browser or a phone app.

  • We keep only the key’s SHA-256 fingerprint, which is why you see the key once, when you make it.
  • If a key leaks, make a new one in the console and the old one stops at once.
  • Each account has up to 10 apps, each with its own key, webhook secret and usage.

Start a check POST /v1/checks

Starts a check for the number the person typed, and gives you two links: a ready check page, and the bot in Telegram directly.

Send the person to url: a QR code on a computer, a Telegram button on a phone. Or send them straight to telegram when they are on their phone.

Read a check GET /v1/checks/:id

Gives you the check as it is now. Useful without a webhook, or to make sure before you carry on.

Webhooks

Set an HTTPS link in the console, and we POST to it the moment each check is settled: check.verified or check.mismatch. If your server does not answer 2xx we try again, up to three times.

X-Watad-Signaturet=1760348467,v1=5f2c…a91e

Check the signature

  • Take t and v1 from the X-Watad-Signature header.
  • Compute HMAC-SHA256 with your app’s webhook secret (whs_…) over: t, a dot, then the raw request body.
  • Compare the hex result with v1 in constant time. If they differ, reject the request.

Errors

Every error comes back with an HTTP status and a JSON body holding a fixed code you can rely on in your code.

Limits

  • 1,000
  • free checks a month, per app
  • minutes before a check expires
  • apps per account
  • 600
  • requests a minute per IP address

Need more? The Business plan has no limit, with a bot in your own name and direct support.

Ready to start?

Your key is ready in a minute, and your first checks are free.