Nava

SMS forwarding and verification code API

How it works

Nava receives forwarded SMS messages from your phones, extracts verification codes, and makes them queryable over a simple HTTP API or real-time event stream.

Authentication & URL tokens

Pass your UUID secret in the Authorization header or append ?token=<UUID> to any URL. Each UUID accesses only its own messages. URL tokens work alongside all filters:

# Standard header:
Authorization: Bearer <UUID>

# URL token parameter:
?token=<UUID>

# Filter by device_id:
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&device_id=pixel-8&format=json&token=<UUID>"

# Filter by device_name:
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&device_name=Google%20Pixel%208&token=<UUID>"

Endpoints

POST GET /api/auth/verify

Verify extension licenses and run 24-hour periodic check-ins. Confirms the secret key is valid and company access remains active.

# 24-hour periodic check
curl "https://nava.imartrioss.workers.dev/api/auth/verify?token=<API_SECRET>"

# Check-in with extension metadata
curl -X POST https://nava.imartrioss.workers.dev/api/auth/verify \
  -H "Authorization: Bearer <API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "extensionId": "company-autofill",
    "version": "1.0.0"
  }'

Chrome Extension background service worker (24h recurring alarm):

chrome.runtime.onInstalled.addListener(() => {
  chrome.alarms.create("licenseCheck", { periodInMinutes: 1440 });
  checkLicense();
});

chrome.alarms.onAlarm.addListener((alarm) => {
  if (alarm.name === "licenseCheck") checkLicense();
});

async function checkLicense() {
  const secret = "85d8ecf6-5641-451a-a41d-20927eeccd28";
  try {
    const res = await fetch("https://nava.imartrioss.workers.dev/api/auth/verify?token=" + secret);
    const data = await res.json();
    await chrome.storage.local.set({ extensionActive: Boolean(res.ok && data.valid) });
  } catch {
    await chrome.storage.local.set({ extensionActive: false });
  }
}
POST GET /api/auth/license

Admin endpoint to check license status, view the last extension check-in, or suspend access remotely.

# Inspect current status
curl "https://nava.imartrioss.workers.dev/api/auth/license?token=<API_SECRET>"

# Suspend access
curl -X POST https://nava.imartrioss.workers.dev/api/auth/license \
  -H "Authorization: Bearer <API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"status": "suspended"}'

# Reactivate access
curl -X POST https://nava.imartrioss.workers.dev/api/auth/license \
  -H "Authorization: Bearer <API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"status": "active"}'
POST /api/sms

Forward an incoming SMS message. Parses the OTP code, stores the record, updates cache, and records device battery telemetry.

curl -X POST https://nava.imartrioss.workers.dev/api/sms \
  -H "Authorization: Bearer <API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "sender": "BANKMELLI",
    "body": "Your code is: 982104",
    "timestamp": 1725800000000,
    "device_id": "pixel-8",
    "device_name": "Google Pixel 8",
    "batteryLevel": 85,
    "isCharging": true
  }'
GET /api/sms?mode=code

Returns the latest verification code as plain text. Supports device filtering and URL tokens.

# Plain text code
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&token=<UUID>"

# Filtered by device_id
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&device_id=pixel-8&token=<UUID>"

# Filtered by device_name
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&device_name=Google%20Pixel%208&token=<UUID>"

# Filtered by device_name with JSON output
curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&device_name=Google%20Pixel%208&format=json&token=<UUID>"
GET /api/sms?mode=code&sender=:name

Fetch the newest code from a specific sender (e.g. mellat, snapp, google).

curl "https://nava.imartrioss.workers.dev/api/sms?mode=code&sender=mellat&token=<API_SECRET>"
GET /api/sms?mode=list

Returns recently extracted codes as a JSON array. Supports &device_id=:id and &limit=:n (default 20, max 100).

curl "https://nava.imartrioss.workers.dev/api/sms?mode=list&device_id=pixel-8&limit=10&token=<API_SECRET>"
GET /api/sms?mode=full

Returns full database records including sender, raw body, and device details. Add &device_id=:id or &id=<uuid>.

curl "https://nava.imartrioss.workers.dev/api/sms?mode=full&device_id=pixel-8&token=<API_SECRET>"
POST /api/ping

Phone telemetry heartbeat. Updates battery level, charging status, and device metadata.

curl -X POST https://nava.imartrioss.workers.dev/api/ping \
  -H "Authorization: Bearer <API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "alive",
    "batteryLevel": 90,
    "isCharging": false,
    "deviceInfo": "Pixel 8"
  }'
GET /api/status

Check phone heartbeat health. Flags isStale: true if no heartbeat was received in the last 35 minutes.

curl "https://nava.imartrioss.workers.dev/api/status?token=<API_SECRET>"
GET /api/sms/stream

Server-Sent Events stream for instant push delivery of incoming codes.

curl -N "https://nava.imartrioss.workers.dev/api/sms/stream?token=<API_SECRET>"