OTP SMS API for verification codes
Send one-time passwords from your backend with one HTTPS request to BroadNet's REST API. Your application generates and checks the code; we deliver it from a registered sender ID over direct operator routes and report every status to your webhook.
curl -X POST https://api.broadnet.me/sms/sendSms \
-H "Authorization: Bearer $BROADNET_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"senderId": "OmniDemo",
"destinationNumber": "971500000000",
"message": "482913 is your OmniDemo code. It expires in 5 minutes. Do not share it.",
"messageType": "TEXT",
"campaignName": "login-otp"
}'
# 200 OK
2603121407537573731Sending an OTP with the SMS API. The token, sender ID and number are placeholders.
Short answer
Updated
To send an OTP by SMS with OmniChannels.ai, your backend generates the code and calls POST /sms/sendSms on https://api.broadnet.me with a bearer token, your sender ID, the number and the message. The API returns a message ID, and delivery statuses reach your webhook. Unicode and Arabic are supported, and WhatsApp or voice can act as fallbacks.
What the OTP SMS API gives developers
One REST call per code
POST /sms/sendSms with a JSON body and a bearer token. The response is the message ID you store against the verification attempt.
Delivery statuses by webhook
Receive SUBMITTED, SENT, DELIVERED, FAILED and REJECTED in one normalised format, so you know when to offer a resend or switch channel.
Unicode and Arabic codes
Set messageType to UNICODE for Arabic or other scripts. POST /sms/identify returns the encoding and segment count before you send.
Registered sender IDs
Send from an alphanumeric sender ID registered for transactional traffic in markets that require it, such as the UAE and Saudi Arabia.
Number lookup before sending
POST /sms/lookup checks a number against the network (HLR and MNP), helping you reject invalid numbers before you pay to send a code.
WhatsApp and voice fallback
Fall back to a WhatsApp authentication template or a voice call when the SMS is not delivered or the code is not entered.
SMPP for very high volume
If you already run an SMPP client, send OTPs over SMPP 3.4 with TLS on the same routes and receive receipts on the session.
SDK and MCP server
Use the TypeScript SDK @broadnet/cpaas-sdk, the OpenAPI 3.1 spec or the MCP server for AI agents.
What your code does and what the API does
A clear split keeps verification secure: your system owns the code, the platform owns delivery.
| Item | Details |
|---|---|
| Generate the code | Your backend creates a random code, stores a hash with an expiry time and limits attempts per number, device and IP address. |
| Send the SMS | POST /sms/sendSms with senderId, destinationNumber (country code plus number, digits only), message and messageType. |
| Track delivery | Store the returned message ID and match webhook statuses to it. A missing DELIVERED within your timeout can trigger a fallback. |
| Verify the code | Your backend compares what the user typed with the stored hash. The platform never checks or stores your verification state. |
| Fall back | Resend on WhatsApp with an authentication template, or by voice call, which our team provisions with you. |
| Pricing | Charged per SMS segment by destination at BroadNet's published list rates, with no setup fee and no monthly minimum. See SMS pricing by country. |
How to integrate the OTP SMS API
- 1
Get your token
Request access; a bearer token is issued for your account and test messages go to your own verified numbers.
- 2
Register a sender ID
Choose a transactional sender ID and register it in the countries that require it before going live.
- 3
Write the message
Put the code first, name your brand, state the expiry and add a do-not-share warning. Keep it to one segment.
- 4
Send and track
Call POST /sms/sendSms, store the message ID and handle webhook statuses idempotently.
- 5
Add fallback and limits
Add WhatsApp or voice as the next step, and rate-limit requests to block SMS pumping before launch.
When the OTP SMS API is the right fit
A good fit when
- You build sign-up, login or payment verification into your own app and want full control of the code.
- You need OTPs to the UAE, Saudi Arabia and other GCC and MENA markets, in Arabic and English.
- You want one API for SMS now and WhatsApp, RCS or voice fallback later.
- You prefer REST and webhooks, with SMPP available when volumes grow.
Good to know before you start
- There is no hosted verify endpoint: your application generates, stores and checks the code.
- Production access is reviewed by our team; there is no instant self-serve signup.
- Sender ID registration takes days in some countries, so start it before your launch date.
- OTP endpoints are a target for SMS pumping fraud; country allow-lists, rate limits and bot checks are your responsibility in the app.
Channel fallback, step by step
Send once through the platform or the API. If a step isn't delivered in time, the next channel takes over automatically, and every status comes back in one webhook format.
- 01
WhatsApp
Rich template with buttons, read receipts and replies in the inbox
- 02
RCS
Branded rich card where the handset and operator support RCS
- 03
SMS
Reaches every mobile phone over direct operator routes
- 04
Voice
A spoken code or message when text isn't getting through
OTP SMS API questions
How do I send an OTP SMS with the API?
Generate the code in your backend, then call POST https://api.broadnet.me/sms/sendSms with an Authorization: Bearer header and a JSON body containing senderId, destinationNumber, message and messageType. The response is the message ID, and delivery statuses arrive at your webhook.
Does the API generate and verify the code for me?
No. Your application generates the code, stores a hash with an expiry and checks what the user enters. Keeping verification in your own system means the code logic, attempt limits and audit trail stay under your control.
Can I send OTP SMS in Arabic?
Yes. Set messageType to UNICODE. Arabic SMS fits 70 characters per segment, so keep the message short. You can call POST /sms/identify first to get the encoding and segment count.
What is the best OTP SMS message format?
Start with the code, name your brand, give the expiry time and warn the user never to share the code, all in one segment. Use a transactional sender ID and keep offers out, so networks do not filter the message as marketing.
What should I do if the OTP SMS is not delivered?
Watch the webhook statuses for the message ID. If you do not see DELIVERED, or the user does not enter the code within your timeout, offer a resend or switch to WhatsApp or a voice call. Do not retry endlessly to the same number.
How do I protect my OTP endpoint from SMS pumping?
Allow only the countries you serve, rate-limit by number, device and IP address, add a bot check on public forms and alert on spikes in requests to unusual prefixes. A number lookup before sending also helps reject invalid numbers.
How much does an OTP SMS cost?
OTP SMS is charged per segment at the destination's rate. BroadNet's indicative list rates per country are on the SMS pricing pages, for example from US$0.0123 per segment to the UAE. There is no setup fee or monthly minimum; your quote confirms the rates.
Is there a sandbox?
Test access sends to your own verified numbers on the same API, so you test real delivery and statuses before production. There is no separate public sandbox and no instant self-serve signup.
Guides on this topic
- SMS & OTPOTP Messages on WhatsApp and SMS: Security, Delivery and Fraud9 min read
- SMS & OTPSMS Pumping Fraud: How AIT Works and How to Stop It9 min read
- IntegrationMessaging API Integration Guide: REST, SMPP and Webhooks9 min read
Explore more of the platform
Get API access for OTP SMS
Tell us your countries, expected verification volumes and sender ID. We'll issue a token for testing to your own numbers and help you register sender IDs.
Share your stack and what you want to connect. A solutions engineer will follow up.