SMS OTP and 2FA — Verification API for Brazil

import { SMSGo } from '@orynlabs/smsgo'

const smsgo = new SMSGo({ apiKey: process.env.SMSGO_KEY })

const otp = await smsgo.send({
  phone: '+5511999990000',
  message: 'Your SMSGo verification code is 184502. Valid for 5 minutes.',
})

console.log(otp.id, otp.status)

// Signed webhook delivered to your endpoint
import { verifyWebhookSignature } from '@orynlabs/smsgo'

app.post('/webhook/smsgo', (req, res) => {
  const signature = req.headers['x-smsgo-signature']
  const payload = JSON.stringify(req.body)

  // Verify the HMAC-SHA256 signature before processing
  const isValid = verifyWebhookSignature(payload, signature, process.env.SMSGO_WEBHOOK_SECRET)
  if (!isValid) return res.status(401).send('invalid')

  console.log(req.body.status, req.body.phone)
  res.status(200).send('ok')
})