Built for
your system, not just our console

Published 4 October 2026 · HantarSMS

OTP and transactional sends go out immediately

A request with three numbers or fewer is now submitted to the carrier as soon as it is accepted, instead of waiting behind bulk campaigns in the queue. That is exactly what a verification code, a password reset or an order confirmation looks like: one number, a person waiting on the other end.

The OTP section of the API docs covers the rest: keeping a code to one segment, using an Idempotency-Key so a retry never sends twice, and why you should offer a "resend" button rather than retrying automatically.

Send limits that fit your traffic

The default is 60 send requests per minute per key, which suits batch sending. Sign-up and login traffic cannot be batched, so peaks can be higher. Tell us your expected peak on WhatsApp and we will raise the limit for your account, up to 1,000 requests a minute.

Reconciliation that adds up

• Every message now reports refunded_cent alongside cost_cent. When some numbers are rejected and refunded, what the message actually cost you is cost_cent − refunded_cent, on the message itself and in the list endpoint.
• Timestamps are documented precisely. Every time the API returns is UTC; the docs now say so explicitly, with the exact formats, so nobody ends up eight hours off.
• Per-number errors are plain English and the docs show the real wording, so what you log matches what you read.

Your first request in under a minute

When you create an API key in the console, we now show a ready-to-run test command with your new key and your own phone number already filled in. Paste it into a terminal and you will receive a real SMS. A 201 with a message id means you are connected.

Docs you can rely on

We checked every promise in the API documentation against the live behaviour: every example request, every field in every response, every error code and HTTP status, every limit. Each of those checks now runs as an automated test whenever we change the code, so the docs and the API cannot drift apart without us knowing.

Security

• API keys are stored only as a hash, can be revoked instantly, and you can hold several (one per environment).
• The API does not send CORS headers, so a key cannot be used from a browser page.

Ready to connect? Create an account, generate a key on the API keys tab, and run the test command it gives you.