Engineering2 min read
2FA at Scale Without the Per-Verification Tax
Most 2FA APIs bill you per verification and cap you out. Here's a flat-rate, no-hard-caps way to verify users at scale over iMessage — with a live demo you can try right now.
Most 2FA APIs bill you per verification and cap you out. Here's a flat-rate, no-hard-caps way to verify users at scale over iMessage — with a live demo you can try right now.
Two-factor authentication is table stakes, but the way most teams buy it quietly punishes growth. Every SMS OTP API — Twilio Verify, Vonage, AWS — meters you per verification. The more users you protect, the more you pay, and the bigger the target you paint for SMS pumping fraud. Doing 2FA at scale shouldn't mean your security bill grows linearly with every new user — but with metered OTP, it does.
A typical verification API charges roughly $0.05 per verification on top of the underlying carrier SMS fee. That sounds tiny until you run the numbers on a product that's actually working:
We built a demo that flips the flow. Instead of us sending a code to the user, the user sends a code to us — straight from their own iMessage. Blooio watches for the inbound message, matches the one-time code, and hands your app back the verified identifier (phone number or email).
You can try it right now at demo.blooio.com/2fa. It generates a code, opens Messages with that code pre-filled, and verifies the moment you hit send.
The verification logic is almost nothing — Blooio delivers every inbound message to your webhook, and you just match the code:
// Blooio delivers every inbound message to your webhook.
// Match the one-time code and read the verified sender.
app.post('/webhook/blooio', async (c) => {
const event = await c.req.json();
if (event.event === 'message.received') {
const code = event.text.trim();
const challenge = await challenges.get(code);
if (challenge) {
// event.sender is the verified phone number or email
await challenge.verify(event.sender);
}
}
return c.json({ ok: true });
});There's no demo call, no DUNS number, and no procurement cycle. You sign up, claim a line, drop in your webhook, and you're verifying users the same afternoon. For around $100/month you get a dedicated iMessage line with no per-verification fees and no hard caps — pricing that stays flat while your user base grows.
Try the live demo, then wire it into your own app in an afternoon.
Try the 2FA demo
Sending a single message is straightforward. Ensuring reliable delivery of millions of messages presents a significant engineering challenge.
If your business relies on SMS, message delivery is more challenging than ever. Carriers use advanced methods to detect spam and noncompliant traffic. Businesses that don't follow A2P 10DLC rules risk having messages filtered, delayed, or blocked.
App Clips, iMessage Apps (app extensions), and rich links are easy to confuse. Here's exactly what each one is, when to use it, and how to send App Clips and iMessage Apps over an API.