Make the trust boundary visible.
Authentication sits between your customer and your application. Being able to inspect its behavior matters: how a challenge is created, what sender evidence is accepted, how expiry is enforced and what your backend validates before it acts.
The Sendity project separates the core verification flow, channel handling, browser client and application integrations. You can review the relevant code, test the behavior against your requirements and run a service with your own configuration. The public repositories are the place to inspect source and each package’s license.
Visibility is useful evidence for a review. It is not a security certification or a promise that every deployment is configured safely. Pair source review with appropriate updates, operational checks and a clear understanding of what the verification result proves.
Choose who operates the service.
| Responsibility | Hosted Sendity | Self-hosted Sendity |
|---|---|---|
| Verification service | Operated by Sendity. | Operated in your chosen infrastructure. |
| Service operations | Managed deployment, monitoring and service maintenance. | You manage deployment, monitoring, updates and incident response. |
| Application management | Hosted customer area, plan limits and billing. | Your server configuration and application management. |
| Accounts & permissions | Your application controls users, consent and sessions. | Your application controls users, consent and sessions. |
| Cost model | Published Sendity plan and usage charges. | Your infrastructure, channel providers and operating work. |
Hosted Sendity suits teams that want to integrate the flow and have Sendity operate it. Self-hosting suits teams that want direct control over deployment, channel setup and the verification service’s operating environment.
Self-hosting includes the work behind the endpoint.
You need a reachable HTTPS service, protected signing and provider credentials, configured channels, a production cache and locks, and a way to observe failures. Test real incoming messages, expired challenges and duplicate deliveries before relying on a deployment.
Self-hosting moves the Sendity service into your infrastructure. Email and phone verification still depend on the channel providers you configure. A self-hosted WhatsApp integration continues to involve Meta, its account requirements and its pricing rules.
Decide what verification records you retain, who can access them and how you handle deletion. Your chosen deployment should fit your organization’s data and operating requirements; the source license does not make those decisions for you.
Start with the deployment you can support.
Use the quickstart to understand the browser-to-backend integration. For your own server, follow self-hosted installation and campaign configuration. To compare responsibilities in more detail, read the hosted and self-hosted guide.
If you prefer a managed service, explore the hosted plans. The verification flow remains understandable and inspectable whichever deployment you choose.