Get started

Build with DevLayer

DevLayer gives you one predictable API for generating reCAPTCHA Solutions, FCM Token, and Email OTP resources across every supported application channel.

First request in under five minutes

Create a workspace, copy your API key, and follow the quickstart below.

Create account

Quickstart#

All requests start with a resource type and channel identifier, then use the same asynchronous lifecycle. Pick a resource and channel below and the example updates with the exact type and channel values to send — no guessing.

Resource

Channel

1Create an API keyGenerate a live API key from your workspace.2Send a requestCall the resources endpoint from your secure backend.3Handle the resultPoll status or receive the completed event via webhook.

request.sh

curl --request POST \
  --url https://api.devlayer.store/v1/resources \
  --header 'Authorization: Bearer xp_live_•••' \
  --header 'Content-Type: application/json' \
  --data '{
    "type": "captcha",
    "channel": "telegram_android_play_store",
    "site_key": "<your channel's Telegram reCAPTCHA site key>",
    "action": "signup",
    "callback_url": "https://api.example.com/webhooks"
  }'

ResponseJSON201 Created

{
  "id": "req_8YF2k9",
  "object": "resource_request",
  "type": "captcha",
  "channel": "telegram_android_play_store",
  "status": "queued",
  "created_at": "2026-07-17T09:24:18Z"
}

Authentication#

Authenticate every server-side request with an API key in the Authorization header. Never expose secret keys in browser or mobile client code.

Authorization: Bearer xp_live_your_secret_key

Secret keys are server-side only.

Anyone with a live key can spend your balance. Store it in an environment variable and rotate it immediately if it leaks.

Keep keys scoped.

Use separate credentials for production, development, and external integrations.

Resource model#

Every request names a resource type and a channel, then returns an object you can poll or receive by webhook. The three resource types share the same request shape.

reCAPTCHA Solutionscaptcha

Solve reCAPTCHA challenges for any supported application channel.

FCM Tokenfcm_token

Provision Firebase Cloud Messaging push tokens for device registration.

Email OTPemail_otp

Retrieve one-time email verification codes during account onboarding.

Channels#

The channel field selects the application build a resource is generated for. Send one of the identifiers below exactly as written.

Channel	Identifier	Status
Telegram Android Play Store	`telegram_android_play_store`	Available
Telegram Android Web	`telegram_android_web`	Available
Telegram Android Beta	`telegram_android_beta`	Available
Telegram Android X	`telegram_android_x`	Partial

captcha requires the channel's site_key.

Each Telegram build is solved against its own fixed reCAPTCHA site_key and action (signup). Send the site_key for the channel — a missing key returns site_key_required and a wrong key returns wrong_site_key. In both cases no token is billed or returned, so a rejected token never reaches Telegram silently.

Request lifecycle#

Each request moves through a small, consistent set of states. This makes retries and observability straightforward across products.

1queued2processingdelivered

Webhooks#

Receive signed lifecycle events at your HTTPS endpoint. Verify the X-DevLayer-Signature header before processing each event.

resource.processingRequest processing began.

resource.deliveredResource is available.

resource.failedRequest ended with a terminal error.

Errors and retries#

DevLayer uses standard HTTP status codes and stable machine-readable error identifiers. Retry only 429 and 5xx responses with exponential backoff.

Status	Error code	Meaning
400	`invalid_request`	The request body is malformed or missing a field.
400	`site_key_required`	A captcha request was sent without a site_key.
400	`wrong_site_key`	The site_key does not match the channel's Telegram reCAPTCHA key — no token is solved.
400	`wrong_action`	The captcha action does not match the channel's reCAPTCHA action.
400	`captcha_unsupported`	No captcha solver is available for the requested channel.
401	`authentication_error`	The API key is missing, revoked, or invalid.
402	`insufficient_balance`	Your workspace balance can't cover the request — top up to continue.
403	`permission_error`	The key lacks the required scope for this endpoint.
404	`not_found`	No resource request matches the supplied id.
429	`rate_limited`	Too many requests — back off and retry.
500	`server_error`	A transient error on our side — safe to retry.

Security#

Production integrations use TLS, scoped credentials, webhook signatures, audit events, and configurable request limits.

TLS 1.2+ on every request and webhook delivery
Scoped, revocable credentials per environment
Signed webhooks with the X-DevLayer-Signature header
Immutable audit events for every state change
Configurable per-key request and concurrency limits

API reference#

Base URL https://api.devlayer.store/v1. Every endpoint requires a bearer key and returns JSON.

POST/v1/resources

Create a new resource request.

GET/v1/resources/:id

Retrieve current request state.

GET/v1/resources

List recent requests with cursor pagination.

GET/v1/balance

Current workspace balance (USDT) for the authenticated key.

Changelog#

Jul 17, 2026

v1 · developer previewAPI v1 developer preview

Introduced reCAPTCHA Solutions, FCM Token, and Email OTP resource types, signed webhooks, and the first four application channels.

Jun 30, 2026

v0 · private alphaPrivate alpha

Opened the resources endpoint and API credentials to a small group of early integration partners.