Confirm a phone, an email or an identity

You will add verify to your app, send a phone code and check it, confirm an email address, and ask an identity question for one market. It takes about 15 minutes, and everything runs on the local driver with no provider account.

You need

• A MainSDK app with a main.yaml (see Thirty-minute path).
• For the email step, email set up and an origin for the link: links.base or verify.email.base.

1. Declare verify

Start on the local driver. Codes stay in an outbox that tests read, so nothing is sent.

verify:
  driver: local
  email: { base: https://app.example.com }

2. Send a phone code and check it

verify.phone() normalises the number, makes a six-digit code and answers { sent: true, id, expiresAt }, the same for every number. verify.phone.check() answers { ok: true, number } once, and { ok: false } for a wrong, expired or used code.

import { verify } from "mainsdk/verify";

export async function confirm(number: string, typed: (id: string) => Promise<string>) {
  const started = await verify.phone({ number });
  const check = await verify.phone.check({ id: started.id, code: await typed(started.id) });
  return check.ok ? check.number : null;
}

Pass the incoming req to verify.phone({ number, req }) so the bot-defence door and the per-IP limit see the caller.

3. Confirm an email address

verify.email() sends a link through email. Your route at email.path reads the token and calls verify.email.confirm(token), ideally on a POST.

import { verify } from "mainsdk/verify";

export async function POST(req: Request) {
  const { token } = (await req.json()) as { token: string };
  return Response.json({ confirmed: (await verify.email.confirm(token)).ok });
}

4. Ask an identity question for one market

Name the driver for each market and the level it requires, then ask for the claims you need. age_over_18 is enough to sell age-restricted goods.

verify:
  driver: local
  identity: { in: digilocker, default: local }
  require: { in: substantial }

import { verify } from "mainsdk/verify";

export async function ageCheckUrl(user: string) {
  const started = await verify.identity({
    level: "substantial",
    market: "in",
    claims: ["age_over_18"],
    purpose: "Sell age-restricted items",
    user,
    consent: { policy: "privacy-2026-10" },
  });
  return started.url;
}

5. Go live

Set driver to twilio-verify or bird and give it secret: credentials under drivers. Set verify.key so every instance can check a code another sent. Run one send in the provider's sandbox before launch.

Check it worked

Run npx mainsdk check. It passes when every market in verify.require is served by a driver that reaches the level it requires; otherwise it reports MAIN-VERIFY-0004 with the line.