Get started

Build with DevLayer

DevLayer gives you one predictable API for generating reCAPTCHA Solutions, FCM Token, and Email OTP resources across every supported application channel.

First request in under five minutes

Create a workspace, copy your sandbox key, and follow the quickstart below.

Create account

Quickstart#

All requests start with a resource type and channel identifier, then use the same asynchronous lifecycle. This example requests a reCAPTCHA resource from the Play Store channel.

1Create an API keyGenerate a sandbox or production credential from your workspace.2Send a requestCall the resources endpoint from your secure backend.3Handle the resultPoll status or receive the completed event via webhook.

request.sh

curl --request POST \
  --url https://api.devlayer.store/v1/resources \
  --header 'Authorization: Bearer xp_live_•••' \
  --header 'Content-Type: application/json' \
  --data '{
    "type": "captcha",
    "channel": "telegram_android_play_store",
    "callback_url": "https://api.example.com/webhooks"
  }'

ResponseJSON201 Created

{
  "id": "req_8YF2k9",
  "object": "resource_request",
  "type": "captcha",
  "channel": "telegram_android_play_store",
  "status": "processing",
  "created_at": "2026-07-17T09:24:18Z"
}

Authentication#

Authenticate every server-side request with an API key in the Authorization header. Never expose secret keys in browser or mobile client code.

Authorization: Bearer xp_live_your_secret_key

Secret keys are server-side only.

Anyone with a live key can spend your balance. Store it in an environment variable and rotate it immediately if it leaks.

Keep keys scoped.

Use separate credentials for production, development, and external integrations.

Resource model#

Every request names a resource type and a channel, then returns an object you can poll or receive by webhook. The three resource types share the same request shape.

reCAPTCHA Solutionscaptcha

Solve reCAPTCHA challenges for any supported application channel.

FCM Tokenfcm_token

Provision Firebase Cloud Messaging push tokens for device registration.

Email OTPemail_otp

Retrieve one-time email verification codes during account onboarding.

Request lifecycle#

Each request moves through a small, consistent set of states. This makes retries and observability straightforward across products.

1queued2processingdelivered

Webhooks#

Receive signed lifecycle events at your HTTPS endpoint. Verify the X-DevLayer-Signature header before processing each event.

resource.processingRequest processing began.

resource.deliveredResource is available.

resource.failedRequest ended with a terminal error.

Errors and retries#

DevLayer uses standard HTTP status codes and stable machine-readable error identifiers. Retry only 429 and 5xx responses with exponential backoff.

Status	Error code	Meaning
400	`invalid_request`	The request body is malformed or missing a field.
401	`authentication_error`	The API key is missing, revoked, or invalid.
404	`not_found`	No resource request matches the supplied id.
429	`rate_limited`	Too many requests — back off and retry.
500	`server_error`	A transient error on our side — safe to retry.

Security#

Production integrations use TLS, scoped credentials, webhook signatures, audit events, and configurable request limits.

TLS 1.2+ on every request and webhook delivery
Scoped, revocable credentials per environment
Signed webhooks with the X-DevLayer-Signature header
Immutable audit events for every state change
Configurable per-key request and concurrency limits

API reference#

Base URL https://api.devlayer.store/v1. Every endpoint requires a bearer key and returns JSON.

POST/v1/resources

Create a new resource request.

GET/v1/resources/:id

Retrieve current request state.

GET/v1/resources

List recent requests with cursor pagination.

Changelog#

Jul 17, 2026

v1 · developer previewAPI v1 developer preview

Introduced reCAPTCHA Solutions, FCM Token, and Email OTP resource types, signed webhooks, and the first four application channels.

Jun 30, 2026

v0 · private alphaPrivate alpha

Opened the resources endpoint and sandbox credentials to a small group of early integration partners.