---
title: "OTP SMS API for verification codes"
description: "Send OTP SMS through one REST call with a bearer token, Unicode and Arabic support, registered sender IDs, webhook delivery statuses and voice fallback."
canonical: "https://omnichannels.ai/channels/sms/otp-api/"
language: "en"
updated: "2026-10-10"
publisher: "BroadNet Technologies"
brand: "OmniChannels.ai"
---

# OTP SMS API for verification codes

Canonical: https://omnichannels.ai/channels/sms/otp-api/
Language: en
Publisher: OmniChannels.ai by BroadNet Technologies

Send one-time passwords from your backend with one HTTPS request to BroadNet's REST API. Your application generates and checks the code; we deliver it from a registered sender ID over direct operator routes and report every status to your webhook.

**Short answer:** To send an OTP by SMS with OmniChannels.ai, your backend generates the code and calls POST /sms/sendSms on https://api.broadnet.me with a bearer token, your sender ID, the number and the message. The API returns a message ID, and delivery statuses reach your webhook. Unicode and Arabic are supported, and WhatsApp or voice can act as fallbacks.

## What the OTP SMS API gives developers

- **One REST call per code:** POST /sms/sendSms with a JSON body and a bearer token. The response is the message ID you store against the verification attempt.
- **Delivery statuses by webhook:** Receive SUBMITTED, SENT, DELIVERED, FAILED and REJECTED in one normalised format, so you know when to offer a resend or switch channel.
- **Unicode and Arabic codes:** Set messageType to UNICODE for Arabic or other scripts. POST /sms/identify returns the encoding and segment count before you send.
- **Registered sender IDs:** Send from an alphanumeric sender ID registered for transactional traffic in markets that require it, such as the UAE and Saudi Arabia.
- **Number lookup before sending:** POST /sms/lookup checks a number against the network (HLR and MNP), helping you reject invalid numbers before you pay to send a code.
- **WhatsApp and voice fallback:** Fall back to a WhatsApp authentication template or a voice call when the SMS is not delivered or the code is not entered.
- **SMPP for very high volume:** If you already run an SMPP client, send OTPs over SMPP 3.4 with TLS on the same routes and receive receipts on the session.
- **SDK and MCP server:** Use the TypeScript SDK @broadnet/cpaas-sdk, the OpenAPI 3.1 spec or the MCP server for AI agents.

## What your code does and what the API does

| Item | Details |
|---|---|
| Generate the code | Your backend creates a random code, stores a hash with an expiry time and limits attempts per number, device and IP address. |
| Send the SMS | POST /sms/sendSms with senderId, destinationNumber (country code plus number, digits only), message and messageType. |
| Track delivery | Store the returned message ID and match webhook statuses to it. A missing DELIVERED within your timeout can trigger a fallback. |
| Verify the code | Your backend compares what the user typed with the stored hash. The platform never checks or stores your verification state. |
| Fall back | Resend on WhatsApp with an authentication template, or by voice call, which our team provisions with you. |
| Pricing | Charged per SMS segment by destination at BroadNet's published list rates, with no setup fee and no monthly minimum. See SMS pricing by country. |

## How to integrate the OTP SMS API

1. **Get your token:** Request access; a bearer token is issued for your account and test messages go to your own verified numbers.
2. **Register a sender ID:** Choose a transactional sender ID and register it in the countries that require it before going live.
3. **Write the message:** Put the code first, name your brand, state the expiry and add a do-not-share warning. Keep it to one segment.
4. **Send and track:** Call POST /sms/sendSms, store the message ID and handle webhook statuses idempotently.
5. **Add fallback and limits:** Add WhatsApp or voice as the next step, and rate-limit requests to block SMS pumping before launch.

## When the OTP SMS API is the right fit

### A good fit when

- You build sign-up, login or payment verification into your own app and want full control of the code.
- You need OTPs to the UAE, Saudi Arabia and other GCC and MENA markets, in Arabic and English.
- You want one API for SMS now and WhatsApp, RCS or voice fallback later.
- You prefer REST and webhooks, with SMPP available when volumes grow.

### Good to know before you start

- There is no hosted verify endpoint: your application generates, stores and checks the code.
- Production access is reviewed by our team; there is no instant self-serve signup.
- Sender ID registration takes days in some countries, so start it before your launch date.
- OTP endpoints are a target for SMS pumping fraud; country allow-lists, rate limits and bot checks are your responsibility in the app.

## OTP SMS API questions

### How do I send an OTP SMS with the API?

Generate the code in your backend, then call POST https://api.broadnet.me/sms/sendSms with an Authorization: Bearer header and a JSON body containing senderId, destinationNumber, message and messageType. The response is the message ID, and delivery statuses arrive at your webhook.

### Does the API generate and verify the code for me?

No. Your application generates the code, stores a hash with an expiry and checks what the user enters. Keeping verification in your own system means the code logic, attempt limits and audit trail stay under your control.

### Can I send OTP SMS in Arabic?

Yes. Set messageType to UNICODE. Arabic SMS fits 70 characters per segment, so keep the message short. You can call POST /sms/identify first to get the encoding and segment count.

### What is the best OTP SMS message format?

Start with the code, name your brand, give the expiry time and warn the user never to share the code, all in one segment. Use a transactional sender ID and keep offers out, so networks do not filter the message as marketing.

### What should I do if the OTP SMS is not delivered?

Watch the webhook statuses for the message ID. If you do not see DELIVERED, or the user does not enter the code within your timeout, offer a resend or switch to WhatsApp or a voice call. Do not retry endlessly to the same number.

### How do I protect my OTP endpoint from SMS pumping?

Allow only the countries you serve, rate-limit by number, device and IP address, add a bot check on public forms and alert on spikes in requests to unusual prefixes. A number lookup before sending also helps reject invalid numbers.

### How much does an OTP SMS cost?

OTP SMS is charged per segment at the destination's rate. BroadNet's indicative list rates per country are on the SMS pricing pages, for example from US$0.0123 per segment to the UAE. There is no setup fee or monthly minimum; your quote confirms the rates.

### Is there a sandbox?

Test access sends to your own verified numbers on the same API, so you test real delivery and statuses before production. There is no separate public sandbox and no instant self-serve signup.

Updated: 2026-10-10