Docs

curl https://web-production-c8403.up.railway.app/v1/messages \
  -H "Authorization: Bearer sk_test_YOUR_TEST_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{"to": "00000000", "body": "Таны захиалга баталгаажлаа"}'

// Node.js 18+ (global fetch)
const res = await fetch('https://web-production-c8403.up.railway.app/v1/messages', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer sk_test_YOUR_TEST_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1042', // safe to retry: never sends twice
  },
  body: JSON.stringify({ to: '00000000', body: 'Таны захиалга баталгаажлаа' }),
});
const message = await res.json();
if (!res.ok) throw new Error(`${message.error.code}: ${message.error.message}`);
console.log(message.id, message.status); // msg_… queued

// npm install @smsmulti/sdk
import { SmsMulti, SmsMultiError } from '@smsmulti/sdk';

const sms = new SmsMulti({ apiKey: 'sk_test_YOUR_TEST_KEY', baseUrl: 'https://web-production-c8403.up.railway.app' });

try {
  const message = await sms.messages.send({ to: '00000000', body: 'Таны захиалга баталгаажлаа' });
  console.log(message.id, message.status);
} catch (err) {
  if (err instanceof SmsMultiError) console.error(err.code, err.message, err.docUrl);
  else throw err;
}

# pip install requests
import requests

res = requests.post(
    "https://web-production-c8403.up.railway.app/v1/messages",
    headers={
        "Authorization": "Bearer sk_test_YOUR_TEST_KEY",
        "Idempotency-Key": "order-1042",
    },
    json={"to": "00000000", "body": "Таны захиалга баталгаажлаа"},
    timeout=30,
)
message = res.json()
if not res.ok:
    raise RuntimeError(f"{message['error']['code']}: {message['error']['message']}")
print(message["id"], message["status"])

# 1. Send a code (test mode answers with "test_code")
curl https://web-production-c8403.up.railway.app/v1/otp \
  -H "Authorization: Bearer sk_test_YOUR_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to": "00000000", "app_name": "MyShop"}'
# -> {"id": "ver_…", "status": "pending", "expires_at": "…", "test_code": "123456"}

# 2. Check what the user typed
curl https://web-production-c8403.up.railway.app/v1/otp/check \
  -H "Authorization: Bearer sk_test_YOUR_TEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id": "ver_…", "code": "123456"}'
# -> {"id": "ver_…", "status": "approved", "valid": true}

import { SmsMulti } from '@smsmulti/sdk';

const sms = new SmsMulti({ apiKey: 'sk_test_YOUR_TEST_KEY', baseUrl: 'https://web-production-c8403.up.railway.app' });

const otp = await sms.otp.send({ to: '00000000', app_name: 'MyShop' });
// …later, with the code the user typed:
const { valid } = await sms.otp.check({ id: otp.id, code: userInput });
if (!valid) throw new Error('Wrong or expired code');

import express from 'express';
import { verifyWebhook } from '@smsmulti/sdk';

const app = express();

// Keep the raw body: re-serialized JSON will not verify.
app.post('/webhooks/sms', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyWebhook({
    payload: req.body,
    headers: req.headers,
    secret: process.env.SMSMULTI_WEBHOOK_SECRET, // whsec_…
  });
  if (!ok) return res.status(400).end();

  const event = JSON.parse(req.body.toString('utf8'));
  if (event.type === 'message.delivered') {
    // event.data is the message object
  }
  res.status(200).end(); // any 2xx; we retry anything else
});

import { createHmac, timingSafeEqual } from 'node:crypto';

/** Standard Webhooks: v1,<base64 HMAC-SHA256(secret, id.timestamp.body)>. */
export function verify(rawBody, headers, secret, toleranceSeconds = 300) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = headers['webhook-signature'];
  if (!id || !timestamp || !signatures) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = createHmac('sha256', key).update(`${id}.${timestamp}.${rawBody}`).digest();

  // During a secret rotation two signatures are sent, space-separated.
  return signatures.split(' ').some((part) => {
    const [version, sig] = part.split(',');
    if (version !== 'v1' || !sig) return false;
    const given = Buffer.from(sig, 'base64');
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}