Direct phone verification (trusted partner)

curl --request POST \
  --url https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations \
  --header 'Content-Type: application/json' \
  --header 'X-Request-ID: <x-request-id>' \
  --header 'x-api-key: <api-key>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "phoneCountryCode": "+1",
  "phoneNumber": "5551234567",
  "verificationEvidence": {
    "partnerReferenceId": "PARTNER-VRF-12345",
    "verificationMethod": "sms",
    "verifiedAt": "2026-05-01T10:00:00Z",
    "externalProviderId": "onfido",
    "externalReferenceId": "onfido-check-abc123",
    "additionalDetails": "Verified during account opening with SMS OTP"
  },
  "enable2Fa": false
}
'

import requests

url = "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations"

payload = {
    "phoneCountryCode": "+1",
    "phoneNumber": "5551234567",
    "verificationEvidence": {
        "partnerReferenceId": "PARTNER-VRF-12345",
        "verificationMethod": "sms",
        "verifiedAt": "2026-05-01T10:00:00Z",
        "externalProviderId": "onfido",
        "externalReferenceId": "onfido-check-abc123",
        "additionalDetails": "Verified during account opening with SMS OTP"
    },
    "enable2Fa": False
}
headers = {
    "X-Request-ID": "<x-request-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Request-ID': '<x-request-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    phoneCountryCode: '+1',
    phoneNumber: '5551234567',
    verificationEvidence: {
      partnerReferenceId: 'PARTNER-VRF-12345',
      verificationMethod: 'sms',
      verifiedAt: '2026-05-01T10:00:00Z',
      externalProviderId: 'onfido',
      externalReferenceId: 'onfido-check-abc123',
      additionalDetails: 'Verified during account opening with SMS OTP'
    },
    enable2Fa: false
  })
};

fetch('https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'phoneCountryCode' => '+1',
    'phoneNumber' => '5551234567',
    'verificationEvidence' => [
        'partnerReferenceId' => 'PARTNER-VRF-12345',
        'verificationMethod' => 'sms',
        'verifiedAt' => '2026-05-01T10:00:00Z',
        'externalProviderId' => 'onfido',
        'externalReferenceId' => 'onfido-check-abc123',
        'additionalDetails' => 'Verified during account opening with SMS OTP'
    ],
    'enable2Fa' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Request-ID: <x-request-id>",
    "x-api-key: <api-key>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations"

	payload := strings.NewReader("{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Request-ID", "<x-request-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations")
  .header("X-Request-ID", "<x-request-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Request-ID"] = '<x-request-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "data": {
    "verified": true,
    "verificationLevel": 1,
    "verifiedAt": "2026-05-03T12:10:00Z",
    "verificationSource": "partnerVerified",
    "partnerReferenceId": "PARTNER-VRF-12345"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

Phone Verification

Direct phone verification (trusted partner)

Rate limit: 60 requests per 60 seconds. This is a shared quota — the same budget is consumed by a group of related endpoints, so calling any of them reduces what is left for the others (you cannot call each at the full rate independently). Endpoints sharing this quota:

POST /api/v1/users/phone/verifications
POST /api/v1/users/phone/verifications/confirmations

Allows trusted partners to directly verify a user’s phone number without OTP.

SECURITY - Partner Ownership Validation: The system validates that the user was created by this partner (affiliateId match). A partner can ONLY verify phone numbers for users originally created by that partner.

POST

api

users

phone

verifications

direct-confirmations

Direct phone verification (trusted partner)

curl --request POST \
  --url https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations \
  --header 'Content-Type: application/json' \
  --header 'X-Request-ID: <x-request-id>' \
  --header 'x-api-key: <api-key>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "phoneCountryCode": "+1",
  "phoneNumber": "5551234567",
  "verificationEvidence": {
    "partnerReferenceId": "PARTNER-VRF-12345",
    "verificationMethod": "sms",
    "verifiedAt": "2026-05-01T10:00:00Z",
    "externalProviderId": "onfido",
    "externalReferenceId": "onfido-check-abc123",
    "additionalDetails": "Verified during account opening with SMS OTP"
  },
  "enable2Fa": false
}
'

import requests

url = "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations"

payload = {
    "phoneCountryCode": "+1",
    "phoneNumber": "5551234567",
    "verificationEvidence": {
        "partnerReferenceId": "PARTNER-VRF-12345",
        "verificationMethod": "sms",
        "verifiedAt": "2026-05-01T10:00:00Z",
        "externalProviderId": "onfido",
        "externalReferenceId": "onfido-check-abc123",
        "additionalDetails": "Verified during account opening with SMS OTP"
    },
    "enable2Fa": False
}
headers = {
    "X-Request-ID": "<x-request-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Request-ID': '<x-request-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    phoneCountryCode: '+1',
    phoneNumber: '5551234567',
    verificationEvidence: {
      partnerReferenceId: 'PARTNER-VRF-12345',
      verificationMethod: 'sms',
      verifiedAt: '2026-05-01T10:00:00Z',
      externalProviderId: 'onfido',
      externalReferenceId: 'onfido-check-abc123',
      additionalDetails: 'Verified during account opening with SMS OTP'
    },
    enable2Fa: false
  })
};

fetch('https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'phoneCountryCode' => '+1',
    'phoneNumber' => '5551234567',
    'verificationEvidence' => [
        'partnerReferenceId' => 'PARTNER-VRF-12345',
        'verificationMethod' => 'sms',
        'verifiedAt' => '2026-05-01T10:00:00Z',
        'externalProviderId' => 'onfido',
        'externalReferenceId' => 'onfido-check-abc123',
        'additionalDetails' => 'Verified during account opening with SMS OTP'
    ],
    'enable2Fa' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Request-ID: <x-request-id>",
    "x-api-key: <api-key>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations"

	payload := strings.NewReader("{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Request-ID", "<x-request-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations")
  .header("X-Request-ID", "<x-request-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/users/phone/verifications/direct-confirmations")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Request-ID"] = '<x-request-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"phoneCountryCode\": \"+1\",\n  \"phoneNumber\": \"5551234567\",\n  \"verificationEvidence\": {\n    \"partnerReferenceId\": \"PARTNER-VRF-12345\",\n    \"verificationMethod\": \"sms\",\n    \"verifiedAt\": \"2026-05-01T10:00:00Z\",\n    \"externalProviderId\": \"onfido\",\n    \"externalReferenceId\": \"onfido-check-abc123\",\n    \"additionalDetails\": \"Verified during account opening with SMS OTP\"\n  },\n  \"enable2Fa\": false\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "data": {
    "verified": true,
    "verificationLevel": 1,
    "verifiedAt": "2026-05-03T12:10:00Z",
    "verificationSource": "partnerVerified",
    "partnerReferenceId": "PARTNER-VRF-12345"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

{
  "success": false,
  "error": {
    "code": "InvalidPhoneCountryCode",
    "message": "PhoneCountryCode must be a valid E.164 country code prefix.",
    "details": "<string>",
    "field": "<string>",
    "value": "<unknown>"
  }
}

Authorizations

x-api-key

string

header

default:lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

required

API key of the application. Only valid together with the x-user-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. The pair is granted the same permissions the operation's OAuth scopes describe.

Demo credential for trying the API from these docs: lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

x-user-key

string

header

default:eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

required

User-specific authentication key. Only valid together with the x-api-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it.

Demo credential for trying the API from these docs: eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

Headers

X-Request-ID

string<uuid>

required

Body

application/json

phoneCountryCode

string

required

Country dial code in E.164 prefix format.

Pattern: ^\+[1-9][0-9]{0,3}$

Example:

"+1"

phoneNumber

string

required

Phone number digits without country code.

Pattern: ^[0-9]{6,15}$

Example:

"5551234567"

verificationEvidence

object

required

Evidence of the partner's verification process.

Show child attributes

enable2Fa

boolean

When true, enables two-factor authentication upon successful verification.

Example:

false

Response

Phone verified successfully

success

boolean

Example:

true

data

object

Show child attributes

⌘I

Getting started

Partners API

Changelog

Direct phone verification (trusted partner)

Authorizations

Headers

Body

Response