JavaScript

function postToVerify(verifyUrl, handoff, extras = {}) {
  const f = document.createElement("form");
  f.method = "POST";
  f.action = verifyUrl;                 // bare endpoint, no query string
  f.style.display = "none";

  const add = (name, value) => {
    const i = document.createElement("input");
    i.type = "hidden";
    i.name = name;
    i.value = value;
    f.appendChild(i);
  };

  add("hx", handoff);                   // the handoffField from /session
  Object.entries(extras).forEach(([k, v]) => v && add(k, v));

  document.body.appendChild(f);
  f.submit();
}

async function startVerify() {
  const r = await fetch("/verify/start", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    credentials: "include",
    body: JSON.stringify({
      action: "payment",              // your own value — login, phone-change, approval, …
      params: { paymentId: 8842 },    // whatever that action needs
      destination: "0501234567",
    }),
  });
  const data = await r.json();
  if (!data.verifyUrl || !data.handoff) throw new Error("no handoff");
  postToVerify(data.verifyUrl, data.handoff);   // optional: { lang: "ar" }
}

https://yourapp.com/verify/done?session_id=vs_9f3c8a…&state=…

// On /verify/done — ask YOUR backend; never "verify" from the URL.
const outcome = await fetch("/verify/result" + location.search, {
  credentials: "include",
}).then((r) => r.json());
render(outcome.ok ? "Verified" : "Verification failed");