v1 · Stable

Assure API

Replace verification codes with trusted conversations. A simple API to send one-tap approval requests over Apple Messages for Business, Google RCS, and WhatsApp Business.

Get API Key View Quickstart

One request

Send a verification and Assure picks the best channel automatically.

Real-time webhooks

Get notified the moment a customer approves — signed and verifiable.

Trusted by default

Verified business identity across Apple, Google, and WhatsApp.

Authentication

Authenticate with your API key

Every request is authenticated with a bearer token. Keep your live keys secret — never ship them in client-side code. Rotate keys anytime from the dashboard.

Authorization: Bearer ASSURE_API_KEYBase URL: https://api.assure.chat/v1

Quickstart

Create a verification request

Send a verification and Assure delivers it on the best available channel for your customer — falling back to SMS only if none are supported.

POST /v1/verification_requests

curl https://api.assure.chat/v1/verification_requests \
  -H "Authorization: Bearer ASSURE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer": { "phone": "+15551234567" },
    "brand": "chase",
    "channel_preference": [
      "apple_messages", "google_rcs", "whatsapp", "sms_fallback"
    ],
    "purpose": "login_approval",
    "message": {
      "title": "Approve this sign in?",
      "body": "We noticed a login from a new device.",
      "actions": [
        { "id": "approve", "label": "Approve", "style": "primary" },
        { "id": "not_me",  "label": "Not Me",  "style": "danger"  }
      ]
    },
    "metadata": {
      "ip_address": "203.0.113.42",
      "device": "MacBook Pro",
      "location": "Denver, CO"
    },
    "expires_in": 300
  }'

200 OK

{
  "id": "vrq_01HY9X8K7P6M9A2Z",
  "status": "pending",
  "selected_channel": "apple_messages",
  "conversation_id": "conv_8K7P6M9A2Z",
  "expires_at": "2026-07-02T19:45:00Z",
  "fallback_available": true
}

Customer experience

What your customer sees

Verified business identity, rich context, and a single tap to approve — right inside the messaging app they already use.

9:41􀋙 􀛨

Chase Verified business

Approve this sign in?

We noticed a login from a new MacBook Pro near Denver, CO.

No codes. No copy/paste. Just tap Approve.

Sender identity is cryptographically verified.
Context (device, location, IP) is shown in-message.
One-tap approve or Not Me — no codes, ever.
Fallback to SMS is transparent and automatic.

Verification requests

Check verification status

Poll for status or (recommended) subscribe to webhooks to receive real-time updates the moment a customer responds.

GET /v1/verification_requests/{id}

curl https://api.assure.chat/v1/verification_requests/vrq_01HY9X8K7P6M9A2Z \
  -H "Authorization: Bearer ASSURE_API_KEY"

200 OK

{
  "id": "vrq_01HY9X8K7P6M9A2Z",
  "status": "approved",
  "approved_at": "2026-07-02T19:42:18Z",
  "customer_action": "approve",
  "channel": "apple_messages"
}

Webhooks

Listen for verification events

Configure an endpoint on your server. Assure will POST signed events as they happen, so your app can react immediately.

POST /webhooks/assureRetries with exponential backoff · 15s delivery timeout

Example event

{
  "id": "evt_01HY9XB4S9ZQ",
  "type": "verification.approved",
  "created": "2026-07-02T19:42:18Z",
  "data": {
    "verification_request_id": "vrq_01HY9X8K7P6M9A2Z",
    "status": "approved",
    "customer_action": "approve",
    "channel": "apple_messages",
    "brand": "chase",
    "metadata": {
      "ip_address": "203.0.113.42",
      "device": "MacBook Pro",
      "location": "Denver, CO"
    }
  }
}

Webhook event types

Event	Description
verification.created	A verification request was created
verification.delivered	Message was delivered
verification.approved	Customer approved
verification.denied	Customer selected Not Me
verification.expired	Request expired
verification.failed	Verification failed
verification.fallback_triggered	SMS fallback was used

Security

Verify webhook signatures

Every webhook is signed with your webhook secret. Verify the Assure-Signature header on every request using a constant-time comparison.

import crypto from "crypto";

export function verifyAssureSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}

Channels

Supported delivery channels

Assure automatically selects the highest-quality channel available for each customer and falls back to SMS only when nothing else is supported.

Apple Messages for Business

Best experience on iPhone. Verified business conversations with rich actions.

Google RCS

Rich, branded conversations on Android where supported.

WhatsApp Business

Trusted global messaging for participating customers.

SMS Fallback

Optional fallback for unsupported devices — no code required.

Integration patterns

Works with your existing identity stack

Drop Assure in between your identity provider and your customers. No re-platforming required.

  Your App
     │
     ▼
  Identity Provider
     │
     ▼
  Assure API  ─────────┐
     │                 │
     ▼                 ▼
  Apple Messages    Google RCS
  WhatsApp          SMS Fallback
     │
     ▼
  Customer Approval
     │
     ▼
  Webhook  →  Your App

Supported platforms

Twilio VerifyAuthsignalOktaAuth0Microsoft Entra IDPing IdentityForgeRockAmazon CognitoCustom identity platforms

Common use cases

New device approval

Payment approval

Fraud alert

Account recovery

Password reset

High-risk transaction approval

Errors

Predictable error responses

Errors return a machine-readable type and code alongside a human-readable message.

400 Bad Request

{
  "error": {
    "type": "invalid_request",
    "code": "customer_phone_required",
    "message": "A valid customer phone number is required."
  }
}

Rate limits

Fair, generous limits

Production accounts start at 1,000 requests per second. Contact us for higher throughput or dedicated capacity.

SDKs

Official libraries

First-party SDKs with type safety, retries, and webhook helpers built in.

Node.js

npm i @assure/node

Python

pip install assure

go get github.com/assure/assure-go

Ready to stop sending verification codes?

Start building trusted conversations in minutes.

Get API Key Contact Sales