Test mode

Every account has two modes, each with its own API keys, webhook endpoint, webhook secret, sessions and rules:

Objects never cross modes: a test session can only be verified by a simulated SMS, and a live session only by a real one. The mode field on every object and event tells you which one you're looking at.

Playground in the Dashboard

Before writing any code, open Playground in the Dashboard to run the whole flow in your browser: create a session, simulate the user's SMS and watch the webhook arrive. It calls POST /v1/test/mo below with your test API key.

Simulate an SMS

POST /v1/test/mo simulates a user-sent SMS (MO SMS) to 150073. It works only with test API keys.

curl -X POST https://api.2fa.mn/v1/test/mo \
  -H "Authorization: Bearer sk_test_..." \
  -H "Content-Type: application/json" \
  -d '{ "from": "99112233", "text": "482913" }'

Response 202 Accepted:

{ "id": "mo_4h6j8k" }

The message goes through the same matching as a real one, and the result arrives at your test webhook. Each client can send up to 30 test SMS per minute; beyond that you get 429 rate_limited.

Scenarios to try

• Happy path: create a session, then send its code from the same number. Expect verification.succeeded.
• Wrong number: create a session with phone: "99112233", then send the code from 88112233. The session stays pending.
• Expiry: create a session and wait 5 minutes. Expect status expired and a session.expired webhook.
• Reuse: send the code of an already verified session again. Nothing new happens; sessions are single-use.
• Rule: create a rule with prefix HIHI, then send hihi 123. Expect rule.matched with text: "hihi 123".
• Webhook failure: make your endpoint return 500. Test webhooks are sent once and are not retried; the delivery log shows failed. Live webhooks are retried.