Request body

Try it

Send a request to see the response.

Example response

{ "success": "SMS sent successfully." }

Errors

Notes

• The OTP stays valid for 5 minutes.
• You can send at most 3 OTPs per phone number per hour (your own verified number is exempt).

Request body

Try it

Send a request to see the response.

Example response

{
  "user": {
    "uid": "f1e2d3c4-...",
    "identifier": "+213555123456",
    "country": "DZ",
    "createdAt": "2026-09-18T10:00:00.000Z",
    "lastLogin": "2026-09-18T10:02:13.000Z",
    "projectId": "my-project-id",
    "customerId": "<userId>",
    "type": "sms"
  }
}

Errors

Notes

• Only the latest OTP for that phone number is checked.
• On first success, a user record is created for that phone. Later verifications update the last login time.
• A successful check does not invalidate the OTP early — it remains usable until it expires.

Request body

Try it

Send a request to see the response.

Example response

{
  "success": "SMS sent successfully.",
  "encoding": "GSM-7",
  "smsLength": 47,
  "pduCount": 1,
  "cost": 7.5
}

Errors

Notes

• The template must be approved before you can send it.
• Placeholders look like {{name}}. Every required placeholder must have a non-empty value.
• You can send at most 5 fields; each value can be up to 40 characters.
• Cost is based on SMS segments. The response includes encoding, length, segment count, and cost. See SMS segments (PDU).

Request body

Available WhatsApp templates

These approved templates are ready to send. Click Try this template to load it in the console below and test it.

Try it

Send a request to see the response.

Example response

{ "success": "WhatsApp message sent successfully." }

Errors

Notes

• The template must be approved before it can be sent — every template listed on this page is approved.
• Sending requires an API key, a Project ID that belongs to your account, and enough balance (4 per message, unless pro).
• parameters maps to the template body placeholders in order; headerParameters (when present) maps to the header.
• Copy-code buttons (OTP templates) automatically use the first value you pass in parameters.
• The account API key is sent as the key header. Keep it private — never expose it in client-side code.

Calculator

How it works

1. 1

   Encoding

   All characters in the GSM 7-bit alphabet → GSM-7. Any other character (Arabic, emoji, …) → Unicode for the whole message.

2. 2

   Length

   GSM-7: basic = 1 septet, extended ^ { } \ [ ] ~ | € = 2. Unicode: UTF-16 code units (emoji often count as 2).

3. 3

   Segments

   GSM-7: 1 if ≤ 160, else ceil(length / 153). Unicode: 1 if ≤ 70, else ceil(length / 67).

Limits

Examples

GSM characters

Click a character to insert it into the calculator. Anything outside this set forces Unicode.

References

• 3GPP TS 23.038 Alphabets (GSM 03.38). GSM-7 default + extension table, UCS-2. Single segment: 160 / 70 in 140 octets.
• 3GPP TS 23.040 SMS technical realization (GSM 03.40). Concatenated segments: 153 GSM-7 / 67 UCS-2 with 6-octet UDH.

Usage

All countries

Who this policy covers

• Customers — developers and businesses who create a smssak account and projects, and call the API. For your account data, smssak decides how it is used.
• End users — the people whose phone numbers you send OTPs and messages to. For this data, you are responsible for having a lawful reason to contact them; smssak only processes it on your behalf to deliver and verify your messages.

Data we collect

How we use data

• Deliver OTPs, SMS notifications, and WhatsApp messages you request, and verify the codes your users enter.
• Authenticate API requests, calculate usage, charge your balance, and show reports and statistics in the console.
• Send you service emails: email verification, password reset, and low-balance alerts.
• Prevent fraud, spam, and abuse, and keep the platform secure and reliable.
• Comply with legal obligations and requests from telecom operators and authorities.

Who we share data with

This documentation site

• The docs site sets no tracking or advertising cookies.
• Your theme preference is saved in your browser's local storage.
• If you use a Try it console, the API key you type is saved in your browser's local storage so you don't have to re-enter it. It is sent only to the smssak API when you press Send request. Clear your browser's site data to remove it.
• Fonts are loaded from Google Fonts, which receives your IP address and browser details when the page loads.

Retention

• OTP codes are valid for 5 minutes and cannot be used after they expire.
• Message, usage, and payment records are kept for as long as your account is active and as needed for billing, dispute resolution, and legal obligations.
• Account and project data is kept until you ask us to delete your account.

Security

• All API and console traffic is encrypted in transit with HTTPS.
• API access requires your secret API key. Keep it server-side, and regenerate it from console Settings if it may have leaked.
• Access to production data is limited to the people who need it to operate the service.

Your responsibilities as a customer

• Only send messages to people who have a relationship with you or have agreed to receive them.
• Tell your users in your own privacy policy that their phone number is shared with smssak to deliver and verify messages.
• Do not put sensitive data (passwords, health, or financial details) in message templates or fields.

Your rights

You can ask to access, correct, or delete your personal data, or object to how it is used. If you are an end user who received a message through smssak, contact the business that sent it first; we will help them respond to your request.

• Email info@smssak.com from the address linked to your account.
• We may ask you to confirm your identity before acting on a request.

Changes to this policy

We may update this policy as the service changes. The "Last updated" date at the top shows the latest version; significant changes are announced by email or in the console.