Before the Sinch Verification API sends a verification code, it can ask your server whether to send it. That matters if your signup form passes the phone number straight to a start call, because then anyone who can reach the form can make your backend text any number they type. This post builds the callback that answers, approving the numbers you serve and denying the rest, together with the TypeScript that starts and checks verifications. You can run and test all of it on your own machine, and put it behind any HTTPS host.

You'll need

A Sinch account and a Verification app in the Sinch Build Dashboard

The application key and application secret of that app (they differ from your project access keys)

Node.js 22 or later

A phone that can receive SMS, and its number in E.164 format, for example +46701234567

A tunnel to your local server to receive real callbacks, for example ngrok

Each verification is billable, and the status response reports the price charged, so test with your own number.

This takes…