Eliminate costly SMS pumping waste. Deliver verified RCS cards with 1-tap approval—backed by a bulletproof, zero-cost inbound SMS fallback.
No credit card required · No 10DLC forms · 100 free verifications
Same login. Two flawless paths.
Ovrtxt detects the device instantly when login starts—the user never chooses. Experience both automated flows below.
Most modern Androids, and iPhones on iOS 18+.
iPhones with RCS off, roaming, or weak cell service.
Opens a text message with your login token already filled in
Secured by Ovrtxt
Secured by Ovrtxt
Outbound codes are a bot's favorite invoice.
| Infrastructure Feature | Legacy SMS (Twilio, Bird) | Ovrtxt Architecture |
|---|---|---|
| SMS Toll Fraud (Pumping) | Vulnerable. Bots drain budget in minutes. | Mathematically impossible. The user texts you. |
| Brand Trust & Identity | Anonymous 6-digit text (Looks like phishing). | Branded RCS card with verified logo & checkmark. |
| Carrier Bureaucracy | 3–6 weeks of 10DLC form hell + monthly taxes. | Instant ISV setup — we are the registered sender. |
| Offline & Low-Service | Code drops silently on roaming/data issues. | Plain MO-SMS delivers instantly on 1 bar of signal. |
| Billing Model | Pay per attempt (You pay for the bot spam). | Pay ONLY for successful human verifications. |
How Ovrtxt Delivers Zero-Fraud Verification
When a user logs in, Ovrtxt detects device capabilities and fires a Branded Rich Card. Your verified logo and dynamic action buttons render securely inside native Messages.
If offline or on a legacy device, Ovrtxt generates a seamless OS deep link (sms:+1800...), instantly opening the native SMS
composer with a pre-filled cryptographic session key.
The user hits "Send" or "Approve". We match the inbound webhook payload to the active browser session and securely log the user in under 800ms.
Built like the auth layer it is.
TLS 1.3 in transit, AES-256 at rest for every active session and webhook payload.
Phone numbers are hashed internally and never appear in plaintext analytics events.
Every payload is cryptographically signed with HMAC-SHA256 for definitive origin verification.
Login tokens execute strict TTL policies, expiring in 90 seconds by default.
An industry first. We only process cryptographic handshakes without storing primary cookies or session tokens.
Every verification attempt, approved or denied, is logged and exportable to your SIEM with SOC 2 readiness.
Ship it in whatever you're already using.
Import your existing number list and route traffic to Ovrtxt in one sprint without downtime.
Drop our SDK into Node.js, Python, or Go. We abstract away carrier routing, device capability detection, and fallback logic so your engineering team can focus on core product.
import { Ovrtxt } from '@ovrtxt/sdk';
// Initialize with your secure API key
const auth = new Ovrtxt({ apiKey: process.env.OVRTXT_SECRET_KEY });
// 1. Trigger Verification (RCS Primary -> MO Fallback)
const session = await auth.verify({
phone: "+15550192834",
brandName: "Joe's Gym",
logoUrl: "https://joesgym.com/logo.png"
});
// 2. Listen for Instant Webhook / WebSocket Auth Match
auth.onSuccess(session.id, (user) => {
console.log(`User ${user.phone} authenticated successfully!`);
});from ovrtxt import Ovrtxt
auth = Ovrtxt(api_key="ovrtxt_sk_live_9283472")
# Trigger zero-fraud verification process
session = auth.verify(
phone="+15550192834",
brand_name="Joe's Gym"
)
print(f"Session initialized: {session.id}")package main
import (
"github.com/ovrtxt/ovrtxt-go"
)
func main() {
client := ovrtxt.NewClient("ovrtxt_sk_live_9283472")
session, _ := client.Verify(&ovrtxt.VerifyParams{
Phone: "+15550192834",
Brand: "Joe's Gym",
})
}curl -X POST https://api.ovrtxt.com/v1/verify \
-H "Authorization: Bearer ovrtxt_sk_live_9283472" \
-H "Content-Type: application/json" \
-d '{
"phone": "+15550192834",
"brandName": "Joe'\''s Gym"
}'What changed after they migrated.
"Our SMS bill had a fraud line item every single month. Since migrating to Ovrtxt's inbound webhook model, that line item is gone — not smaller, entirely gone."
"We went live in a single sprint. No campaign registry paperwork, no waiting on a carrier to approve a use case. The developer experience is phenomenal."
"The branded card alone moved our login completion rate up by 12%. Users actually recognize us now instead of hesitating on a random 10-digit number."
Calculate Your Saved Toll Fraud & Carrier Fees
Estimated Legacy Cost (Twilio + Fraud)
$3,250 / mo
*Includes average 15% bot pumping attempts & 10DLC fees
Ovrtxt Cost ($0.03 Success Only)
$1,500 / mo
You Save: $1,750 / month (53%)
Pay Only for Successful Authentications.
Perfect for startups, apps, and platforms looking to eliminate SMS fraud instantly.
For high-volume platforms and scale-ups with custom SLA and security requirements.
Before you integrate
No 10DLC registration or campaign fees required. For inbound SMS fallback, you can start authenticating users immediately in under five minutes with zero paperwork and no vetting queues. For branded RCS delivery, Ovrtxt acts as your registered Managed ISV sender—Google approval takes a couple of days for Android delivery and operator/carrier approval takes 1–2 weeks for universal delivery, while your SMS fallback protects your logins from day one.
A short cryptographic login token that is already filled into the OS compose sheet for the user. They just tap "Send", and Ovrtxt matches the webhook to the waiting browser session—no code to read, copy, or retype.
Outbound SMS fraud works because a bot can force an API to send a text to a premium international number that you pay for. With Ovrtxt, the *user* sends the text inward via their native OS. There is no outbound message to spam, and hackers cannot profit from receiving a text, making the attack vector obsolete.
Plain SMS runs on the cellular voice channel, meaning it delivers instantly on a single bar of cell service with zero data or roaming required. The OS compose sheet opens pre-filled via deep link—the user just taps send.
Yes. Most enterprise engineering teams utilize a "Shadow Route" strategy. You can route just 5-10% of your login traffic (or traffic in specific high-fraud regions) to Ovrtxt to compare delivery SLAs and cost side-by-side before fully switching.
No. Ovrtxt is built on a Zero-Trust Architecture. Even as the infrastructure provider, we never see your users' session-binding token, application state, or primary session cookies. We only process the cryptographic handshake. We mathematically cannot hijack a session or log into an account on behalf of your users.