An SMS API you'd actually want to use.

Send SMS and OTPs from your app, website, or internal system. Bearer tokens — never passwords in query strings. Signed webhooks, idempotency keys, a real sandbox, and predictable status codes.

curl -X POST https://mobireach.theanathoth.com/api/v1/sms/send \
  -H "Authorization: Bearer $MOBIREACH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"to": ["+256772123456"], "message": "Hello from MobiReach"}'

// Node.js 18+, save as send.mjs
import { randomUUID } from 'node:crypto';

const res = await fetch('https://mobireach.theanathoth.com/api/v1/sms/send', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MOBIREACH_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': randomUUID(),
  },
  body: JSON.stringify({ to: ['+256772123456'], message: 'Hello from MobiReach' }),
});
console.log(await res.json());

import os, uuid, requests

r = requests.post(
    "https://mobireach.theanathoth.com/api/v1/sms/send",
    headers={"Authorization": f"Bearer {os.environ['MOBIREACH_API_KEY']}",
             "Idempotency-Key": str(uuid.uuid4())},
    json={"to": ["+256772123456"], "message": "Hello from MobiReach"},
    timeout=15,
)
print(r.status_code, r.json())

$ch = curl_init('https://mobireach.theanathoth.com/api/v1/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer '.getenv('MOBIREACH_API_KEY'),
        'Content-Type: application/json',
        'Idempotency-Key: '.bin2hex(random_bytes(16)),
    ],
    CURLOPT_POSTFIELDS => json_encode(['to' => ['+256772123456'], 'message' => 'Hello from MobiReach']),
]);
print_r(json_decode(curl_exec($ch), true));

// Go 1.20+, standard library only. Save as main.go and run: go run main.go
package main

import (
	"bytes"
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"os"
	"time"
)

func main() {
	body, _ := json.Marshal(map[string]any{
		"to":      []string{"+256772123456"},
		"message": "Hello from MobiReach",
	})
	idem := make([]byte, 16)
	rand.Read(idem)

	req, _ := http.NewRequest("POST", "https://mobireach.theanathoth.com/api/v1/sms/send", bytes.NewReader(body))
	req.Header.Set("Authorization", "Bearer "+os.Getenv("MOBIREACH_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Idempotency-Key", hex.EncodeToString(idem)) // reuse the same key if you retry

	res, err := (&http.Client{Timeout: 15 * time.Second}).Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer res.Body.Close()

	var out map[string]any
	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
		log.Fatal(err)
	}
	if res.StatusCode >= 400 {
		e := out["error"].(map[string]any)
		log.Fatalf("%v: %v (%v)", e["code"], e["message"], e["request_id"])
	}
	fmt.Println(out["batch_id"], out["messages"])
}

Ship login codes this afternoon.

Two endpoints — send and verify. We handle 6-digit codes, single-use enforcement, 5–10 minute expiry, attempt limits, resend cooldowns, and fraud monitoring. You handle nothing.

Delivery events, pushed to you

Every status change hits your endpoint — signed (HMAC-SHA256 with a timestamp), retried with backoff, and visible in the delivery log with a redeliver button. Includes message id, batch id, status and failure reason.

Scoped keys, shown once

Generate a key, see it once, store only the hash. Rotate with a grace period or revoke anytime. Restrict each key to the scopes, IP ranges and rate limit it needs.