Developer dashboard

The MobileValidate dashboard at app.mobilevalidate.com is where you manage your integration: create and revoke API keys, read the log of every API request, follow usage and cost, and manage webhooks. It works for test and live data, and you can switch between them in the sidebar.

#How do I sign in?

Enter your e-mail address and we send you a 6-digit code. The code is valid for 10 minutes and works once. After your first sign-in, add a passkey (Face ID, Touch ID, Windows Hello or a security key) from Account: next time, one click signs you in, even if e-mail is slow.

• There are no passwords to leak or reset.
• Sessions end after 24 hours without activity and always after 14 days.
• Sensitive actions (creating a key, revoking a live key, changing a webhook endpoint, rotating a secret, changing passkeys) ask you to confirm with your passkey or a fresh code, even when you are signed in.
• Account → Sign out everywhere ends every session on every device.

Signed up with an instant test key? Confirm your e-mail with the link we sent, then sign in with the same address.

#How do I create and manage API keys?

Open API keys and choose Create key:

The full key is shown once, right after you create it. Copy it into a secret manager or an environment variable (MOBILEVALIDATE_API_KEY). The dashboard only shows the key's prefix and last four characters afterwards. You can rename or revoke keys at any time; a revoked key stops working within a minute. An account can have up to 25 active keys. Live keys can be limited to a list of server IP addresses. See authentication.

#What is in the request log?

Request logs lists every authenticated API request of the last 30 days: time, method, endpoint, status, error code, latency, key, mode (test or live) and request id. Filter by status, error code, key, endpoint, mode and time range, or search by a request id (req_…), lookup id (lkp_…) or job id (job_…). Open a row to see all its metadata and a link to the lookup or job, where results are shown with phone numbers and e-mail addresses masked.

The log never stores phone numbers, e-mail addresses, request bodies or query strings. Requests made with the public sandbox key are not logged. Every API response also carries its request_id, so you can find the matching row when you debug.

#How do I see usage and cost?

Usage shows checks and cost by day and by service, for test or live mode. Export the table as CSV for your own reporting. Test checks are always free; live checks are billed only for conclusive results.

#How do I manage webhooks?

Webhooks has separate tabs for test and live endpoints: test keys only ever see and trigger test endpoints, and live events only go to live endpoints.

• Add an endpoint with an HTTPS URL and the events you want. New or changed URLs are verified before events are delivered.
• Rotate the signing secret at any time. For 24 hours we sign each delivery with both the old and the new secret, so you can deploy the new secret without missing events. See webhooks for signature verification.
• Deliveries shows each attempt with its status and response code. Retry a failed delivery, or send a test event to check your receiver.

#How do I go live?

In a test-only account, the dashboard shows Request live access. Tell us about your use case; we review it and approve your account for live use. Then create live keys yourself under API keys. If a request is declined, you can send a new one after 7 days.

#Is the dashboard secure?

• Each account only ever sees its own data: access is enforced in the database, not only in the application.
• Sign-in codes are single-use, expire after 10 minutes and are locked after repeated wrong attempts; passkeys are phishing-resistant.
• Pages are never cached, cookies are secure and bound to app.mobilevalidate.com, and every sensitive action is recorded in your account's security activity.

More about how we protect data: trust and security.