diff --git a/.env.example b/.env.example
index dbd14f5d..c1b759bc 100644
--- a/.env.example
+++ b/.env.example
@@ -314,4 +314,7 @@ WABOT_TOKEN_KEYS_SECOND=cbee7e95cf3ffbfa0531d5fddfd44f87
 # for config STORAGE_DIRECTORY, set value without slash at the end
 # STORAGE_DIRECTORY=/Users/UTM/Sites/lelong/storage
 
-ADMIN_EMAIL="admin_1@example.com,admin_2@example.com"
\ No newline at end of file
+ADMIN_EMAIL="admin_1@example.com,admin_2@example.com"
+
+ONE_WAY_SMS_USERNAME=apiusername
+ONE_WAY_SMS_PASSWORD=apipassword
\ No newline at end of file
diff --git a/app/Http/Controllers/Mobile/UserController.php b/app/Http/Controllers/Mobile/UserController.php
index ab626ca3..83e475f1 100644
--- a/app/Http/Controllers/Mobile/UserController.php
+++ b/app/Http/Controllers/Mobile/UserController.php
@@ -158,8 +158,8 @@ class UserController extends Controller
         $tac_code = rand(100000, 999999);
 
         Http::get('http://gateway.onewaysms.com.my:10001/api.aspx', [
-            'apiusername' => 'APIUK330HDAFO',
-            'apipassword' => 'APIUK330HDAFOUK330',
+            'apiusername' => config('app.one_way_sms_username'),
+            'apipassword' => config('app.one_way_sms_password'),
             'senderid' => 'INFO',
             'mobileno' => $request->phone_number,
             'message' => '[ArrahnBid]: '. $tac_code .' is your TAC code. The code is valid for 5 minutes.',
@@ -176,7 +176,41 @@ class UserController extends Controller
 
         return response()->json([
             'success' => true,
-            'message' => 'Tac Sent!'
+            'message' => 'Tac Sent!',
+            'response' => $tac_code_model
         ]);
     }
+
+    public function verifyTac(Request $request)
+    {
+        $current = Carbon::now();
+        $current_date_time = $current->toDateTimeString();
+
+        $tac_code = TacCode::query()
+            ->where('tac_code', $request->tac_code)
+            ->where('phone_number', $request->phone_number)
+            ->where('expired_at', '>=', $current_date_time)
+            ->where('status', 0)
+            ->first();
+
+        if ($tac_code) {
+            $user = Auth::user();
+            $user->notelbimbit = $request->phone_number;
+            $user->save();
+
+            $tac_code->status = 1;
+            $tac_code->save();
+
+            return response()->json([
+                'success' => true,
+                'message' => 'Update successful!',
+                'user' => $user
+            ]);
+        } else {
+            return response()->json([
+                'success' => false,
+                'message' => 'Error unexpected!',
+            ]);
+        }
+    }
 }
diff --git a/config/app.php b/config/app.php
index d1b2ef31..1854953c 100644
--- a/config/app.php
+++ b/config/app.php
@@ -255,5 +255,10 @@ return [
 
     'taxation' => env('TAX_AROS',true),
 
-    'admin_email' => env('ADMIN_EMAIL', 'admin@example.com')
+    'admin_email' => env('ADMIN_EMAIL', 'admin@example.com'),
+
+    'one_way_sms_username' => env('ONE_WAY_SMS_USERNAME', 'null'),
+
+    'one_way_sms_password' => env('ONE_WAY_SMS_PASSWORD', 'null'),
+
 ];
diff --git a/routes/api.php b/routes/api.php
index 8a732a91..555ae6f3 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -51,6 +51,7 @@ Route::group(['middleware' => ['auth:sanctum']], function () {
     Route::put('/userUpdate/profile', [UserController::class, 'updateProfileUser']);
 
     Route::get('/requestTac', [UserController::class, 'requestTac']);
+    Route::post('/verifyTac', [UserController::class, 'verifyTac']);
 
     //============HOME===========================
     //today's auction