Useful articles
Fraud protection
Per-number and per-IP limits, an IP allowlist and a monthly spend cap. On by default.
SMS pumping attacks try to drain your balance by requesting codes for many numbers. That is why every new project starts with protection on; tune it in your project Settings.
| Setting | Default | When exceeded |
|---|---|---|
| Requests per phone | 5 per 10 minutes | 429 rate_limited |
| Requests per IP | 30 per 10 minutes | 429 rate_limited |
| IP allowlist | Empty (any IP) | 403 forbidden |
| Monthly spend cap | None | 402 spend_cap_reached |
| Checks per code | 5 | Verification locked as failed |
Rate limits
- Per phone: stops anyone flooding the same user with codes and protects your balance. The window can be 1 minute to 24 hours.
- Per IP: counted on the end user's IP that you pass in
client_ip, not on your server's IP, so all your traffic coming from one server is never capped. Withoutclient_ipthe per-IP limit doesn't apply, so always send it. - A
429comes withRetry-After: 60. - Rate limits can be switched off in the settings, though we advise against it.
IP allowlist
Add your servers' addresses (single IPs or IPv4 ranges such as 203.0.113.0/24, up to 50 entries). After that, starting a verification from any other address is refused, even with a leaked key.
Monthly spend cap
A ceiling on net spend (charges minus refunds) per calendar month in UTC. Once reached you get 402 spend_cap_reached and nothing is sent until the next month or until you raise the cap.