Missed Call Verification API

<?php
// Server-side only. Keep YOUR_API_KEY out of your app and out of git.
$ch = curl_init('https://sendpk.com/apps/call/missed-call-auth.php');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: YOUR_API_KEY',
        'Idempotency-Key: signup-7f3a9c2e',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'number'   => '+923330189315',
        'platform' => 'android',
    ]),
]);
$reply = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($reply['success'])) {
    $requestId = $reply['data']['id'];   // save it: you need it to verify
    // Do NOT send $reply['data']['pin_hash'] to your app.
} else {
    error_log('Missed call start failed: ' . $reply['error']['code']);
}

// Node.js 18+ (server-side). Never run this in a browser.
const res = await fetch('https://sendpk.com/apps/call/missed-call-auth.php', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': process.env.SENDPK_API_KEY,
    'Idempotency-Key': 'signup-7f3a9c2e',
  },
  body: JSON.stringify({
    number: '+923330189315',
    platform: 'android',
  }),
});

const reply = await res.json();
if (reply.success) {
  const requestId = reply.data.id;   // save it: you need it to verify
  // Do NOT send reply.data.pin_hash to your app.
} else {
  console.error('Missed call start failed:', reply.error.code);
}

# Server-side only (Python 3, requests).
import os, requests

reply = requests.post(
    'https://sendpk.com/apps/call/missed-call-auth.php',
    headers={
        'Content-Type': 'application/json',
        'Authorization': os.environ['SENDPK_API_KEY'],
        'Idempotency-Key': 'signup-7f3a9c2e',
    },
    json={'number': '+923330189315', 'platform': 'android'},
    timeout=20,
).json()

if reply.get('success'):
    request_id = reply['data']['id']   # save it: you need it to verify
    # Do NOT send reply['data']['pin_hash'] to your app.
else:
    print('Missed call start failed:', reply['error']['code'])

<?php
// $pin comes from your app as a STRING, e.g. "0711" — keep the leading zero.
$ch = curl_init('https://sendpk.com/apps/call/verify.php');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: YOUR_API_KEY',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'id'                => 'REQUEST_ID',
        'pin'               => $pin,
        'use_server_hangup' => true,
    ]),
]);
$reply = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($reply['data']['validated'])) {
    // The number is verified.
} elseif (($reply['error']['code'] ?? '') === 'PIN_INVALID') {
    $left = $reply['error']['details']['attempts_remaining'];   // show this to the user
}

// Node.js 18+ (server-side). pin is a STRING: '0711', not 711.
const res = await fetch('https://sendpk.com/apps/call/verify.php', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': process.env.SENDPK_API_KEY,
  },
  body: JSON.stringify({
    id: requestId,
    pin: pin,
    use_server_hangup: true,
  }),
});

const reply = await res.json();
if (reply.data && reply.data.validated) {
  // The number is verified.
} else if (reply.error && reply.error.code === 'PIN_INVALID') {
  const left = reply.error.details.attempts_remaining;   // show this to the user
}

# pin is a STRING: '0711', not 711.
reply = requests.post(
    'https://sendpk.com/apps/call/verify.php',
    headers={
        'Content-Type': 'application/json',
        'Authorization': os.environ['SENDPK_API_KEY'],
    },
    json={'id': request_id, 'pin': pin, 'use_server_hangup': True},
    timeout=20,
).json()

if reply.get('data', {}).get('validated'):
    pass   # the number is verified
elif reply.get('error', {}).get('code') == 'PIN_INVALID':
    left = reply['error']['details']['attempts_remaining']   # show this to the user

<?php
$ch = curl_init('https://sendpk.com/apps/call/status.php?id=' . urlencode($requestId));
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: YOUR_API_KEY'],
]);
$reply = json_decode(curl_exec($ch), true);
curl_close($ch);

$status  = $reply['data']['status'] ?? null;            // pending | verified | failed | expired | cancelled
$billing = $reply['data']['billing_status'] ?? null;    // pending | charged | not_charged | short

// Node.js 18+ (server-side).
const res = await fetch('https://sendpk.com/apps/call/status.php?id=' + encodeURIComponent(requestId), {
  headers: { 'Authorization': process.env.SENDPK_API_KEY },
});

const reply = await res.json();
const status = reply.data && reply.data.status;            // pending | verified | failed | expired | cancelled
const billing = reply.data && reply.data.billing_status;   // pending | charged | not_charged | short

reply = requests.get(
    'https://sendpk.com/apps/call/status.php',
    params={'id': request_id},
    headers={'Authorization': os.environ['SENDPK_API_KEY']},
    timeout=20,
).json()

status = reply.get('data', {}).get('status')            # pending | verified | failed | expired | cancelled
billing = reply.get('data', {}).get('billing_status')   # pending | charged | not_charged | short

<?php
// Call this when no missed call arrived within 30-40 seconds.
$ch = curl_init('https://sendpk.com/apps/call/cancel.php');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Authorization: YOUR_API_KEY',
    ],
    CURLOPT_POSTFIELDS => json_encode(['id' => $requestId]),
]);
$reply = json_decode(curl_exec($ch), true);
curl_close($ch);

// Node.js 18+ (server-side). Call this when no missed call arrived in 30-40 s.
const res = await fetch('https://sendpk.com/apps/call/cancel.php', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': process.env.SENDPK_API_KEY,
  },
  body: JSON.stringify({ id: requestId }),
});

const reply = await res.json();

# Call this when no missed call arrived within 30-40 seconds.
reply = requests.post(
    'https://sendpk.com/apps/call/cancel.php',
    headers={
        'Content-Type': 'application/json',
        'Authorization': os.environ['SENDPK_API_KEY'],
    },
    json={'id': request_id},
    timeout=20,
).json()

// Node.js + Express (server-side).
const crypto = require('crypto');
const express = require('express');
const app = express();

// IMPORTANT: keep the RAW body — do not let a JSON parser re-encode it.
app.post('/webhooks/missed-call', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body;   // Buffer with the exact bytes we sent
  const expected = 'sha256=' + crypto.createHmac('sha256', process.env.SENDPK_API_KEY).update(rawBody).digest('hex');
  const given = req.get('X-SENDPK-Signature') || '';

  if (expected.length !== given.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(given))) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(rawBody.toString('utf8'));
  // Use event.event_id to ignore repeats.
  res.sendStatus(200);   // answer 2xx within 5 seconds
});

# Flask (server-side).
import hashlib, hmac, os
from flask import Flask, request

app = Flask(__name__)

@app.post('/webhooks/missed-call')
def missed_call_webhook():
    raw = request.get_data()   # the exact bytes we sent
    expected = 'sha256=' + hmac.new(
        os.environ['SENDPK_API_KEY'].encode(), raw, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, request.headers.get('X-SENDPK-Signature', '')):
        return '', 401

    event = request.get_json()
    # Use event['event_id'] to ignore repeats.
    return '', 200   # answer 2xx within 5 seconds