Key to code in five requests.

// quickstart.mjs — Node 18+: PASSCODE_API_KEY=pc_live_… node quickstart.mjs
const API = "https://passcode.sh/api/v1";

async function api(method, path, { body, headers = {} } = {}) {
  const res = await fetch(`${API}${path}`, {
    method,
    headers: {
      Authorization: `Bearer ${process.env.PASSCODE_API_KEY}`,
      ...(body ? { "Content-Type": "application/json" } : {}),
      ...headers,
    },
    body: body ? JSON.stringify(body) : undefined,
  });
  const json = await res.json();
  if (!res.ok) throw new Error(`${json.error.code}: ${json.error.message}`);
  return json;
}

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

// 1. Quote: the best WhatsApp number in the US right now.
const { data: quotes } = await api("GET", "/quote?service=whatsapp&country=US");
const best = quotes.find((q) => q.recommended);
if (!best) throw new Error("Nothing in stock right now. Try another country.");
console.log(`Best offer: $${best.price}, ${Math.round(best.success_rate * 100)}% expected success`);

// 2. Buy exactly that offer. The Idempotency-Key makes a retry safe.
let order = await api("POST", "/orders", {
  body: { service: "whatsapp", offer_id: best.offer_id },
  headers: { "Idempotency-Key": crypto.randomUUID() },
});
console.log(`Enter this number in WhatsApp: ${order.phone_number}`);

// 3. Wait for the code (or use the order.code_received webhook instead).
while (order.status === "pending" || order.status === "waiting") {
  await sleep(3000);
  order = await api("GET", `/orders/${order.id}`);
}

// 4. Use it, then finish. No code? The order is already refunded.
if (order.code) {
  console.log(`Your code: ${order.code}`);
  await api("POST", `/orders/${order.id}/finish`);
} else {
  console.log(`No SMS arrived (${order.status}); refunded at ${order.refunded_at}.`);
}