Reverse OTP over WhatsApp
Say hi.
You're verified.
Your users send one WhatsApp message instead of typing a code. HiVouch matches it to their number in about three seconds. No SMS bills, nothing to intercept, and you pay only when a user is verified.
100 freeverifications every day, on every account, for as long as you use HiVouch.
- 100 free every day
- ~3 s median
- No code to type
- Pay on success
How it works
The message travels the other way
- 1
Tap
Your user taps "Say hi on WhatsApp". WhatsApp opens with the greeting already written.
- 2
Send
They press send. The greeting carries a one-time token tied to their session.
- 3
Verified
HiVouch matches the token to the sender's number, replies "Verified", and calls your webhook.
Compared with SMS
Cheaper than SMS, and nothing to type
| SMS OTP | HiVouch | |
|---|---|---|
| Cost per verified user | Varies by country, often several cents | $0.0005-$0.0017 in every country |
| What the user does | Waits, copies and types 6 digits | Taps, then presses send |
| Failed and resent attempts | You pay for every SMS sent | Free |
| SMS-pumping fraud | Exposed | Not possible: the user sends |
| What it proves | Someone could read the code | The SIM itself sent the message |
SMS prices depend on the destination country and provider, and every resent code costs again. The HiVouch range comes from our package prices, which are the same for every country.
Security
Hard to fake, nothing to steal
SMS codes can be intercepted, phished or pumped. HiVouch turns the check around: the user proves the number by sending from it.
Proof of possession
The message has to come from the WhatsApp account on that number. A verification shows the user holds the phone, not just that they saw a code.
Nothing to phish
There is no code to read out, forward or intercept. Each greeting carries a one-time token tied to the session, and it expires within 15 minutes.
No SMS pumping
HiVouch never sends the first message, so bots cannot run up a bill by requesting codes. Attempts that do not verify are free.
"Not you?" built in
The confirmation tells the user where they are signing in. If it was not them, they reply NO, and you get a dispute webhook.
Signed webhooks
Every webhook carries a HiVouch-Signature header: an HMAC-SHA256 of the timestamp and body, so you can reject forged or replayed calls.
Little data, kept briefly
Phone numbers are encrypted at rest, WhatsApp message records are deleted after 7 days, and servers run in the EU (Helsinki, Finland).
Pricing
Pay only when a user is verified
100 free verifications every day. After that, one price list in USD for every country. Failed, expired and abandoned attempts are always free.
3,000
verifications
$5
$0.0017 each
10,000
verifications
$10
$0.0010 each
50,000
verifications
$40
$0.0008 each
300,000
verifications
$200
$0.00067 each
1,000,000
verifications
$500
$0.0005 each
For developers
Live in an afternoon
Use the hosted page as a standard OpenID Connect provider, drop in the widget, or call the REST API. Signed webhooks, idempotent requests and a full test mode come with every account.
- Works with any OpenID Connect client, with setup guides for Auth0, Keycloak, Cognito, Supabase and Firebase
- A plain REST API you can call from any backend language
- A web widget, and a client channel mobile apps use without the hosted page
const v = await hivouch.verifications.create({
phone: "+447700900142",
locale: "ar",
});
// Show v.wa_link as a button or QR code.
// Your webhook receives:
{
"type": "verification.verified",
"data": { "object": {
"id": "ver_01JC8Z4Q7M",
"verified_phone": "+447700900142",
"latency_ms": 2840
} }
}Start with 100 free verifications a day
Test mode right away. No card needed until you buy a package.