SMS API for Malaysia

What you would use it for

• One-time passwords at login or checkout, sent from a 5-digit short code.
• Order and delivery updates triggered by status changes in your own system.
• Appointment reminders from a scheduler, a day before.
• Internal alerts — a cron job that texts you when something breaks, which reaches you when email and push do not.
• Campaigns from your CRM, without exporting a CSV and pasting it into a web form.

The part most SMS APIs get wrong

Your HTTP client has a timeout. Ours has a network. Sooner or later your request will time out after we created the message but before you got the response — and your retry logic will send it again. Without protection that is a double charge and two SMS to every recipient, and neither is refundable because the operator already billed for both.

Every send accepts an Idempotency-Key header. Retry the same request as many times as you like: the first call does the work, every later call returns the identical response including the same message ID, and nothing is charged twice.

curl https://hantarsms.com/api/v1/messages \
  -H "X-API-Key: $HANTARSMS_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-48213-reminder" \
  -d '{"to":["60123456789"],"text":"Your order #48213 is ready for pickup."}'

Delivery reports, per number

Totals are not much use when a campaign underperforms. The API returns the outcome for each individual number, and it distinguishes two states that many providers collapse into one:

Merging rejected into undelivered makes your invoice impossible to reconcile, because one is billable and the other is not.

What else is in it

• Errors you can branch on. Stable machine codes like insufficient_balance and content_blocked, not prose you have to string-match.
• Content screening before you are charged. Messages containing protected international brand names are rejected with the penalty amount in the response, rather than sent and penalised at RM1.50 per segment.
• Balance endpoint so you can alert yourself before you run out.
• Multiple keys, revocable independently — separate staging from production.
• Same price as the web console. No API surcharge, no monthly platform fee.

Full reference

Endpoints, parameters, every error code and working examples in PHP, Python, Node.js and Java are in the API documentation. It is readable without an account — worth a look before you register, to confirm it fits how your system is built.

Frequently asked questions

Is there a monthly fee for API access?

No. The API costs the same per segment as sending from the web console, with no platform fee, no minimum volume and no separate API plan. You pay for messages.

What happens if my request times out and I retry?

If you sent an Idempotency-Key header, nothing — the retry returns the original response and the same message ID, and you are charged once. Without that header a retry is treated as a new message, so send the header on every request.

Can I use the API to send OTP?

Yes, and that is one of the main uses. Messages go out from a shared 5-digit short code, which is the sender format users expect for one-time passwords. See short code SMS.

How do I get delivery status back?

Poll the message endpoint for a summary, or the recipients endpoint for the per-number breakdown. Status is refreshed from the operator when you read it. Webhook push is on the roadmap; polling is the supported method today.

Which languages do you have examples for?

The documentation has complete working examples in curl, PHP, Python, Node.js and Java. It is a plain REST API with JSON, so any HTTP client works — there is no SDK to install.

Related: Full API documentation · OTP and transactional SMS · SMS gateway and routing · Bulk SMS Malaysia guide