Twilio Verify for teams leaving Authy
Teams migrating off Authy generally land on Twilio Verify. The route records below document the working OTP send/check flow and the webhook signature validation that goes with it.
Sourced from 3 live route records · regenerated 2026-07-08
Documented failure modes
twilio-verifysampled
- Verify codes expire in 10 min and verifications auto-expire — a late check returns 404, not 'wrong code'; handle both paths
- You never see or store the code — don't build flows that need it; that's the point
- A2P/voice restrictions per country still apply; some destinations need a sender ID or are blocked by default geo-permissions
twilio.com/docs/verifysampled
- Verification checks are consumed on each attempt; after a code is used (approved or max attempts reached), you must start a new verification rather than retrying the check.
- Phone numbers must be in E.164 format (e.g., +14155552671); ensure you normalize user input before calling the API.
- Twilio Verify handles carrier-level OTP delivery and retry logic; do not implement your own SMS delivery on top of Verify for OTP use cases.
twilio.comsampled
- Twilio signs requests with HMAC-SHA1 (not SHA-256) — using the wrong algorithm will always produce a mismatch.
- SSL termination proxies and load balancers that change http to https in the URL will break signature validation; reconstruct the URL as Twilio sent it, not as your app server sees it.
- Use the official Twilio helper library's RequestValidator rather than a hand-rolled implementation — edge cases around empty parameters, array parameter ordering, and URL normalisation cause frequent validation failures.
The working procedure
- Create a Verify Service (handles code generation, expiry, retries)
- Start: POST /v2/Services/{sid}/Verifications with to + channel (sms/call/email/whatsapp)
- Check: POST /VerificationCheck with to + code; status 'approved' = success
- Rate-limit per phone/IP on your side as well
Source: Add OTP verification with Twilio Verify — a live route record (status: sampled). Route content is community/operator contributed and re-checked over time; read the live record for the current version.
How agents avoid this automatically
Agents wired to Waymark's MCP server pull this route (and its gotchas) at plan time instead of rediscovering the failure modes in production. Reads are free and keyless.
# Any MCP client — one call, no key:
waymark_query({ "task": "twilio verify otp send and check" })
# Or plain HTTP:
curl -s "https://mcp.waymark.network/search?q=twilio%20verify%20otp%20send%20and%20check"