diff --git a/src/Controller/APIController.php b/src/Controller/APIController.php
index 194c853b..812a2658 100644
--- a/src/Controller/APIController.php
+++ b/src/Controller/APIController.php
@@ -193,6 +193,11 @@ class APIController extends Controller
         return $res->getReturnResponse();
     }
 
+    protected function generateConfirmCode()
+    {
+        return sprintf("%06d", mt_rand(100000, 999999));
+    }
+
     public function confirmNumber(RisingTideGateway $rt, Request $req)
     {
         // check parameters
@@ -213,9 +218,9 @@ class APIController extends Controller
 
         // TODO: validate phone number
 
-        // TODO: generate code and save
-        // use '123456' for now
-        $code = '123456';
+        // generate code and save
+        // $code = '123456';
+        $code = $this->generateConfirmCode();
         $this->session->setConfirmCode($code)
             ->setPhoneNumber($phone_number);
         $em->flush();