Browser & Mobile SDK (REST)

There is no embedded <script> widget to load. For browsers and native mobile apps, Bondify exposes two public endpoints that need only your project_id — no secret key on the client. This is what the React and Flutter SDKs call under the hood, and what you call directly when you have no SDK for your stack.

Enable Mobile SDK under Project → Settings to turn on the public endpoints. Without it, /generate/public and /verify/public return PUBLIC_ACCESS_DISABLED.

Endpoints

Base URL: https://api.bondify.dev

`POST /api/v1/generate/public`

Create a pending session.

// Request
{ "project_id": "proj_xxxxxxxx" }

// Response — 200
{
  "deeplink": "https://t.me/your_bot?start=a1b2c3d4e5f6",
  "session_token": "a1b2c3d4e5f6",
  "expires_at": 1700000600000
}

`POST /api/v1/verify/public`

Poll for the session result. On the first confirmed read, the session becomes used.

// Request
{ "project_id": "proj_xxxxxxxx", "session_token": "a1b2c3d4e5f6" }

// Response — one of:
{ "status": "pending" }
{ "status": "confirmed", "telegram_id": "123", "telegram_name": "Alex",
  "telegram_username": "alex", "telegram_phone": null,
  "proof": "eyJhbGci…", "confirmed_at": 1700000123456 }
{ "status": "cancelled" }
{ "status": "expired" }

Recommended client loop

Generate

Call /generate/public. Keep the session_token.

Open the deep link

Open deeplink (new tab on web, url_launcher/Linking on mobile).

Poll

Call /verify/public every ~2 seconds. Stop on confirmed, cancelled, or expired. The session’s TTL is 10 minutes; you’ll typically also stop polling after a couple of minutes of inactivity.

Verify on your server

Send the proof to your backend and verify it with your webhook_secret.

const PROJECT_ID = 'proj_xxxxxxxx'
const API = 'https://api.bondify.dev'

async function signInWithTelegram() {
  const { deeplink, session_token } = await fetch(`${API}/api/v1/generate/public`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ project_id: PROJECT_ID }),
  }).then(r => r.json())

  window.open(deeplink, '_blank')

  return new Promise((resolve, reject) => {
    const poll = setInterval(async () => {
      const res = await fetch(`${API}/api/v1/verify/public`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ project_id: PROJECT_ID, session_token }),
      }).then(r => r.json())

      if (res.status === 'confirmed') { clearInterval(poll); resolve(res) }
      if (res.status === 'cancelled') { clearInterval(poll); reject(new Error('cancelled')) }
      if (res.status === 'expired')   { clearInterval(poll); reject(new Error('expired')) }
    }, 2000)
  })
}

Error responses

Public endpoints return a 4xx with { "error": "…" } for these conditions:

Condition	Meaning
`PUBLIC_ACCESS_DISABLED`	Enable Mobile SDK in project settings
`PROJECT_NOT_FOUND`	Unknown `project_id`
`PROJECT_INACTIVE`	The project is paused
Rate limited (`429`)	Public generation is capped per IP+project and per project — back off

Prefer an SDK when you have one

If you’re on React/Next.js or Flutter, use the official SDK instead of calling these endpoints by hand — it manages the generate/poll/expiry lifecycle, timeouts, and state for you:

React / Next.js

@bondify/react

Flutter

bondify_flutter — GitHub

REST API reference

All endpoints

Introduction

Get started

Framework guides

Guides

SDK Reference

Security

Dashboard

Changelog

Browser & Mobile SDK (REST)

Endpoints

`POST /api/v1/generate/public`

`POST /api/v1/verify/public`

Recommended client loop

Error responses

Prefer an SDK when you have one

React / Next.js

Flutter

REST API reference

​Endpoints

​POST /api/v1/generate/public

​POST /api/v1/verify/public

​Recommended client loop

​Error responses

​Prefer an SDK when you have one

React / Next.js

Flutter

REST API reference

Endpoints

`POST /api/v1/generate/public`

`POST /api/v1/verify/public`

Recommended client loop

Error responses

Prefer an SDK when you have one