Question 1

What does proof.holdings do?

Accepted Answer

proof.holdings is a verification-as-a-service API. We let businesses verify that users control digital assets — phone numbers, emails, domains, social accounts, crypto wallets — without revealing identity. Think of it as "OAuth for asset ownership, not identity." One API call creates a challenge, the user proves control, and you get a signed cryptographic proof token.

Question 2

How is this different from KYC / identity verification?

Accepted Answer

KYC verifies who someone is (name, ID, address). We verify what someone controls. We never collect identity documents, and we are not an identity provider — we don't store passwords, manage login sessions, or have access to your users' accounts. Our proof tokens demonstrate control without exposing the underlying asset to third parties. You own your user base; we just verify what they control.

Question 3

What is multi-surface proof of control?

Accepted Answer

One API, multiple verification surfaces. Phone numbers (Telegram, SMS, WhatsApp), Email addresses, Domains (DNS, HTTP, Auto-DNS), and Telegram Bots — all through a single unified verification flow. Social accounts and Crypto wallets are coming soon. Each verified asset generates a cryptographic proof token.

Question 4

What are public profiles?

Accepted Answer

Users can create public verification profiles that showcase their verified assets. Each profile gets a shareable URL (/p/ by ID or /u/ by username) with granular privacy controls — choose which assets to display and how much to reveal (full, partial, or hidden masking). Businesses can customize branding and add custom links. Up to 10 profiles per account.

Question 5

What does "air-gapped" verification mean?

Accepted Answer

Your application never handles sensitive credentials directly. The user proves control through our secure verification flow, and you receive a signed proof token. Your backend never sees OTP codes, OAuth tokens, or private keys — the verification happens entirely on our side, air-gapped from your infrastructure. We don't store your users' passwords or control their accounts — proof tokens are cryptographic receipts of control, not session keys or access grants.

Question 6

What is Reverse OTP?

Accepted Answer

Traditional verification sends an SMS or email to the user — you pay for every outbound message. Reverse OTP flips the direction: we show the user a short code, and they send it to us via Telegram, SMS, and WhatsApp. Deep links make it effortless — one tap opens the right app with the code pre-filled. The user initiates, you never send a message. This is not just a cost optimization; it is a fundamentally different model where phone verification scales without per-message cost.

Question 7

Why does user-initiated verification matter?

Accepted Answer

Traditional outbound verification ties your cost directly to your user count. Every login, every 2FA check, every confirmation is an outbound message you pay for. At scale — millions of users, AI agents triggering automated workflows, bots performing continuous re-verification — outbound messaging becomes an unbounded cost liability. User-initiated verification decouples your infrastructure cost from your user count. The user's own messaging app is the delivery mechanism. And you only pay for successful proofs — not for attempts, not for messages sent. Your verification cost is predictable, not a per-message bill that grows with traffic.

Question 8

Is Reverse OTP secure?

Accepted Answer

Yes. Challenge codes are cryptographically generated, stored with a short TTL, and validated with constant-time comparison to prevent timing attacks. Because the user initiates the message from their own device, the attack surface is fundamentally different from traditional OTP: SIM-swap attacks are ineffective because there is no inbound SMS to intercept — the attacker would need physical access to the user's messaging app. Phishing is harder because the user is sending, not receiving.

Question 9

What can I verify?

Accepted Answer

Phone numbers (Telegram, SMS, WhatsApp), email addresses (Magic Link or OTP), domains (DNS TXT, HTTP File, Auto-Verify with 140+ Providers, Email), and Telegram Bots. Social accounts and crypto wallets are coming soon.

Question 10

How does domain verification work?

Accepted Answer

4 methods: DNS (add a TXT record to prove control); HTTP (place a file at /.well-known/); Email (verify via domain webmaster address); Auto-DNS (we add the record automatically via your DNS provider API — 140+ Providers including Cloudflare, AWS Route 53, GoDaddy, Namecheap, and more). DNS and HTTP verifications are free and unlimited.

Question 11

How does SMS verification work?

Accepted Answer

SMS uses the same user-initiated model as WhatsApp and Telegram. The user sends an inbound SMS containing their verification code to a dedicated number. All phone verification channels (Telegram, SMS, and WhatsApp) work identically: display the code, the user sends it via a deep link or manually, verification completes. No outbound messages on any phone channel.

Question 12

Can I use proof.holdings for two-factor authentication (2FA)?

Accepted Answer

Yes. Create a verification with POST /api/v1/verifications, the user sends the code via their preferred channel, then poll GET /api/v1/verifications/:id to confirm completion and retrieve the proof token. Our SDKs handle polling automatically. For returning users, Smart Reuse can skip re-verification if a valid proof already exists — reducing friction without reducing security.

Question 13

Can I build passwordless login with proof.holdings?

Accepted Answer

Yes. We provide a dedicated Sessions API for phone-first authentication flows. Create a session, the user verifies their phone number via WhatsApp, Telegram, or SMS, and you receive a signed proof token to use as your auth credential. No passwords to store, hash, leak, or reset. The same flow works for email (magic link or OTP). You own the session logic; we handle the verification.

Question 14

What are the main use cases?

Accepted Answer

Authentication — login, 2FA, MFA, account recovery, and passwordless flows using phone or email verification. Onboarding — verify merchant domains, business phone numbers, and Telegram bots during KYB. Compliance — cryptographic proof tokens create an auditable record of asset control at a specific point in time. Automation — the REST API and webhooks integrate into CI/CD pipelines, bot workflows, and programmatic verification at any scale.

Question 15

How is this different from Twilio, Vonage, or Auth0?

Accepted Answer

Different category, not different price. Twilio and Vonage are messaging APIs — they deliver SMS and you build verification logic on top. Auth0 is an identity provider — it handles who users are. proof.holdings is a verification primitive — it proves asset control and returns a cryptographic proof token. One API call, works across phone, email, and domain, phone channels are user-initiated with no outbound messaging cost, and proof tokens are offline-verifiable via standard JWKS. You only pay for successful proofs, not for messages. You don't replace these tools; you remove the need for them in asset verification flows.

Question 16

Is there a free tier?

Accepted Answer

Yes. The Pay As You Go plan includes 300 free proofs every month with full API access, all verification channels, and webhook support. No credit card required. Additional proofs are €0.03 each.

Question 17

What plans are available?

Accepted Answer

Pay As You Go (300 free proofs/mo, then €0.03 each), Pro (€29/mo — 3,000 proofs), Business (€79/mo — 10,000 proofs), and Enterprise (custom pricing for 100,000+ proofs with dedicated infrastructure and BYOC).

Question 18

What is BYOC?

Accepted Answer

BYOC (Bring Your Own Channels) is an Enterprise feature where verification messages come from your own Telegram bot, WhatsApp Business number, and email sender — users never see proof.holdings.

Question 19

What happens if I exceed my plan limit?

Accepted Answer

Paid plans have per-proof overage rates (Pro: €0.025, Business: €0.02). On Pay As You Go, you simply pay €0.03 per proof beyond the free 300. Monitor usage in real-time from the dashboard.

Question 20

How do I get started?

Accepted Answer

Three steps: sign up and generate an API key, install one of our SDKs (JavaScript, Python, Go, or PHP), and call createVerification() with an asset type and identifier. The SDK handles polling, retries, and error handling. Full API reference, OpenAPI 3.0 spec, and test vectors are available in our docs. You can also initiate verifications directly from the dashboard without writing any code. First proof in under 10 minutes.

Question 21

How does authentication work?

Accepted Answer

API key authentication via the X-API-Key header. Keys use the format pk_live_* for production and pk_test_* for test mode. Keys are bcrypt-hashed at rest — we never store them in plaintext.

Question 22

Do you support webhooks?

Accepted Answer

Yes. Configure a webhook URL and we send real-time notifications when verifications and verification requests complete. Payloads are signed with HMAC-SHA256 so you can verify authenticity. Failed deliveries retry automatically with exponential backoff, and you can track delivery status and manually retry from the dashboard or API. Webhooks fire in test mode too, so you can test your integration end-to-end without burning credits.

Question 23

What SDKs are available?

Accepted Answer

JavaScript/TypeScript, Python, Go, and PHP. All four SDKs cover the same API surface: verifications, proofs, sessions, verification requests, and webhook deliveries. Each includes full type definitions, automatic retries with exponential backoff, and typed error classes. The Go SDK has zero external dependencies.

Question 24

Can I verify proofs offline?

Accepted Answer

Yes. Proof tokens are RS256-signed JWTs. Download our public keys from the JWKS endpoint (/.well-known/jwks.json) once, then validate any proof locally without contacting our API. All four SDKs include built-in offline verification. This is useful for edge computing, air-gapped environments, or simply reducing API dependency in your verification flow.

Question 25

Is there an OpenAPI spec?

Accepted Answer

Yes. A machine-readable OpenAPI 3.0 specification is available at /api/openapi.json and in our public docs repository. This enables automated SDK generation, API client scaffolding, contract testing in CI, and integration by AI coding assistants that can parse the spec directly.

Question 26

What data do you collect?

Accepted Answer

Only what's needed for verification: the asset identifier (phone, email, domain), verification status, and timestamps. We never collect identity documents, names, or addresses. Credentials and secrets are encrypted at rest using AES-256-GCM. Asset identifiers inside proof tokens are SHA-256 hashed — even the proof itself doesn't reveal the underlying asset in plaintext.

Question 27

Are you GDPR compliant?

Accepted Answer

Yes. Full GDPR compliance including data export (Article 20 — Right to Data Portability), complete account deletion cascade (Article 17 — Right to Erasure), PII masking in logs, and automatic TTL expiration of delivery records.

Question 28

How are proof tokens secured?

Accepted Answer

Proof tokens are signed JWTs using RS256 (asymmetric) for offline verification or HS256 as fallback. Asset identifiers are SHA-256 hashed before inclusion — the token proves control without revealing the asset. Public keys are published at our JWKS endpoint so any party can validate a proof without contacting our API. Tokens support revocation via a published revocation list.

Question 29

What is Human-in-the-Loop (HITL)?

Accepted Answer

HITL lets AI agents and automation pipelines request human approval before taking action. The human receives a message via Telegram or WhatsApp, approves or denies with one tap, and the decision is cryptographically signed as a proof token — just like a verification proof.

Question 30

How do HITL approvals work?

Accepted Answer

Three steps: (1) Create a HITL config with your Telegram or WhatsApp channel. (2) Your agent or pipeline calls POST /api/v1/confirmations with a message like "Deploy to production?" (3) The human approves or denies via Telegram or WhatsApp, and you get a signed proof token of their decision.

Question 31

What channels support HITL approvals?

Accepted Answer

Telegram and WhatsApp. The human receives an inline keyboard (Telegram) or interactive button message (WhatsApp) and taps to approve or deny. They can also add a comment with their decision.

Question 32

Do HITL confirmations count toward my proof quota?

Accepted Answer

Yes. 1 confirmation = 1 proof, with the same pricing as verification proofs. This keeps billing simple — one meter for all trust primitives.

Question 33

Can I use HITL with AI agents?

Accepted Answer

Yes. proof.holdings has 131 MCP tools including create_confirmation, get_confirmation, and list_confirmations. Works with Claude, LangChain, CrewAI, OpenAI Agents SDK, and any MCP-compatible agent framework.

Question 34

What happens if the human doesn't respond?

Accepted Answer

Each confirmation has a configurable timeout (default 1 hour). After timeout, the confirmation status changes to "expired" and your agent can handle the fallback — retry, escalate, or proceed with a default action.

Question 35

How is this different from gotoHuman or HITL Relay?

Accepted Answer

proof.holdings delivers approvals through native messaging experiences — Telegram inline keyboards and WhatsApp interactive buttons — plus a full web dashboard for monitoring and management. Every decision produces a cryptographic proof token (RS256 JWT) you can verify offline, not just a status flag. And proof.holdings combines verification + delegation + approvals in one platform with 131 MCP tools, 4 SDKs, and platform integrations (n8n, Zapier, Make), vs single-purpose approval tools.

Question 36

How does test mode work?

Accepted Answer

Use a pk_test_* API key. In test mode, all channel deliveries are simulated (no real SMS, WhatsApp, or email sent), but webhooks still fire so you can test your integration end-to-end without burning credits.

Question 37

Can I auto-complete test verifications?

Accepted Answer

Yes. The test-verify endpoint (POST /api/v1/verifications/:id/test-verify) instantly completes a verification and generates a proof token. Only works with test API keys — returns 403 for production keys.

Question 38

Do test verifications count toward my quota?

Accepted Answer

No. Test verifications are tracked separately and excluded from billing and production usage limits.

Frequently Asked Questions

What is proof.holdings?

Reverse OTP

Verification Channels

Use Cases

Pricing

API & Integration

SDKs & Developer Experience

Privacy & Security

Human-in-the-Loop (HITL)

Test Mode

Related