Best Twilio Phone Validation API & SMS Verification Integration 2025

async function secure2FA(phoneNumber, userId) {
  try {
    // Validate phone number first
    const validation = await axios.post('https://app.1lookup.io/api/v1/phone', {
      phone_number: phoneNumber
    }, {
      headers: {
        'Authorization': `Bearer ${process.env.ONELOOKUP_API_KEY}`,
        'Content-Type': 'application/json'
      }
    });

    const phoneData = validation.data;
    
    // Risk assessment
    let riskLevel = 'low';
    let requiresAdditionalVerification = false;
    
    if (phoneData.spam_score > 50) riskLevel = 'medium';
    if (phoneData.spam_score > 80) riskLevel = 'high';
    if (phoneData.carrier_type === 'VOIP') riskLevel = 'high';
    
    // High risk phones require additional verification
    if (riskLevel === 'high') {
      requiresAdditionalVerification = true;
      console.log(`High risk phone detected for user ${userId}`);
    }
    
    // Generate code based on risk level
    const codeLength = riskLevel === 'high' ? 8 : 6;
    const verificationCode = Math.random().toString().substr(2, codeLength);
    
    // Store verification attempt with risk data
    await storeVerificationAttempt({
      userId,
      phoneNumber,
      code: verificationCode,
      riskLevel,
      carrierInfo: phoneData.carrier_name,
      location: `${phoneData.city}, ${phoneData.region}`,
      timestamp: new Date()
    });
    
    // Send SMS with appropriate messaging
    let message = `Your verification code is: ${verificationCode}`;
    if (riskLevel === 'high') {
      message += ` (High security verification - valid for 5 minutes)`;
    }
    
    const smsResult = await client.messages.create({
      body: message,
      from: process.env.TWILIO_PHONE_NUMBER,
      to: phoneNumber
    });
    
    return {
      success: true,
      riskLevel,
      requiresAdditionalVerification,
      phoneData,
      twilioSid: smsResult.sid
    };
    
  } catch (error) {
    console.error('2FA setup failed:', error);
    return { success: false, error: error.message };
  }
}

// Verification check with risk awareness
async function verify2FACode(userId, submittedCode) {
  const attempt = await getVerificationAttempt(userId);
  
  if (attempt.riskLevel === 'high') {
    // Stricter validation for high-risk phones
    if (Date.now() - attempt.timestamp > 5 * 60 * 1000) { // 5 minutes
      return { success: false, reason: 'Code expired (high security)' };
    }
  }
  
  if (attempt.code === submittedCode) {
    // Log successful verification with risk data
    await logSuccessfulVerification(userId, attempt.riskLevel);
    return { success: true, riskLevel: attempt.riskLevel };
  }
  
  return { success: false, reason: 'Invalid code' };
}