Integration manual
Call & SMS verification
Bind a customer check and agent confirmation to a short-lived organisation session.
Register your sender
Production sessions require an approved organisation name and phone number or sender ID. Use E.164 for phone numbers. This service verifies sessions; it does not place calls or send SMS. Keep your existing telecom provider.
Create a session
Create a verification session immediately before contacting the customer. Give them its initial code. Sessions expire after 5 minutes and temporarily reserve one allowance unit.
curl https://eu.mimeprotect.com/api/security/call-sessions \
-H "Authorization: Bearer $MIMEPROTECT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"sender":"+442079460000","purpose":"Scheduled account review"}'Customer checks independently
Direct the customer to the trusted verifier at mimeprotect.com/verify-call or your matching regional host. They enter the sender, local receipt time and initial code. New codes include an EU, US or FR prefix that selects the regional service automatically, so customers do not need to choose a region. The code is consumed once and bound to their browser. The page displays the organisation, purpose and rotating return code.
Read and confirm the challenge
Your agent integration reads the current challenge after the customer’s check. Ask the customer to read their code back and submit it once. The server accepts the current 30-second epoch only. Fetch a fresh challenge on rollover; do not cache it. One successful confirmation consumes one verification unit.
curl https://eu.mimeprotect.com/api/security/call-challenge \
-H "Authorization: Bearer $MIMEPROTECT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id":"SESSION_ID"}'
curl https://eu.mimeprotect.com/api/security/call-confirm \
-H "Authorization: Bearer $MIMEPROTECT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id":"SESSION_ID","code":"123456"}'Understand the threat boundary
The result verifies an organisation-created session, not the phone network or physical caller. Real-time code relay remains possible. Never use this alone to authorise payments or account recovery, and never ask customers for passwords or banking authentication codes.
Ready to connect it?
Open your regional workspace, create a sandbox key and test the complete flow with synthetic data. Keep the returned identifiers and inspect every result before moving to production.
Open the sandbox →Discuss your requirements →