---
title: "SMS OTP"
description: "API SMS OTP - Envio de Códigos de Verificação por SMS"
lang: en
canonical: https://doc.apibrasil.io/apis/creditos/b1508a3-bc08-12ef-becf-000c29865f118
markdown: https://doc.apibrasil.io/apis/creditos/b1508a3-bc08-12ef-becf-000c29865f118.md
source: apibrasil-documentation
---

# SMS OTP

> API SMS OTP - Envio de Códigos de Verificação por SMS

- **Category:** Messaging
- **Billing:** per query, with the Bearer Token only
- **Price:** R$0.10 per query
- **Limit:** 990,000 per month
- **Registration:** CPF or CNPJ
- **Version:** v2
- **Published by:** APIBrasil
- **OpenAPI specification:** https://doc.apibrasil.io/apis/creditos/b1508a3-bc08-12ef-becf-000c29865f118/openapi.json

## How to call

**Base address:** `https://gateway.apibrasil.io/api/v2`

Authentication: the `Authorization: Bearer <token>` header. Nothing else.

## Endpoints (1 endpoint)

### 1. POST /sms/send/credits

API SMS Avulso - Envio Instantâneo de SMS OTP com Alta Prioridade

A API SMS Avulso permite o envio rápido e seguro de mensagens SMS OTP com alta prioridade, garantindo que códigos e alertas importantes cheguem imediatamente ao seu usuário. Com integração ágil via endpoint POST, seu sistema ganha flexibilidade e robustez sem complicações técnicas, potencializando a segurança e a eficiência das suas operações de autenticação. O retorno claro e detalhado da API facilita o acompanhamento em tempo real do status de cada envio, agregando valor ao seu negócio. Ideal para empresas que buscam aprimorar a experiência do usuário, aumentar a confiabilidade e otimizar o processo de comunicação em etapas críticas do serviço.

- **Method:** `POST`
- **Address:** `https://gateway.apibrasil.io/api/v2/sms/send/credits`
- **Route version:** v2

**Headers**

| Header | Value |
| --- | --- |
| `Content-Type` | `application/json` |
| `Authorization` | `Bearer $APIBRASIL_TOKEN` |

**Request body**

```json
{
  "tipo": "sms-otp",
  "number": "5531994359434",
  "message": "Mensagens com alta prioridade de entrega",
  "operator": "claro",
  "user_reply": true,
  "webhook_url": "https://webhook.site/b2fdae94-87b9-47b6-9276-52fbc0f8e16c"
}
```

**In cURL**

```bash
curl -X POST "https://gateway.apibrasil.io/api/v2/sms/send/credits" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $APIBRASIL_TOKEN" \
  -d '{"tipo":"sms-otp","number":"5531994359434","message":"Mensagens com alta prioridade de entrega","operator":"claro","user_reply":true,"webhook_url":"https://webhook.site/b2fdae94-87b9-47b6-9276-52fbc0f8e16c"}'
```

**Sample response, from the catalog**

```json
{
  "user": {
    "first_name": "[omitido]",
    "email": "[omitido]",
    "cellphone": "[omitido]",
    "notification": "yes"
  },
  "balance": "250,260",
  "balance_before": "250,370",
  "tax": "0,110",
  "status_code": 200,
  "error": false,
  "message": "Dados validos! Voce foi tarifado em R$ 0,11.",
  "valor_consulta": 0.11,
  "api_limit_for": "credit",
  "homolog": false,
  "response": {
    "data": {
      "created_at": "2026-04-16 12:03:17",
      "id": "194245788769e0d0056659e591427948",
      "status": "processed"
    },
    "message": "Message sent successfully",
    "status": "success"
  }
}
```

In the sample responses, the fields of the account that generated the sample (`user.first_name`, `user.email`, `user.cellphone`) come out as `[omitido]`. The rest is what the catalog publishes.

## Pitfalls: what an integration gets wrong without warning

Established from the responses the catalog itself publishes. In every one of them the code works on the happy path and fails silently everywhere else:

1. **The error arrives in the BODY, with HTTP 200.**
   The response carries a boolean `error` field and a `message`. Checking only `response.ok` or the HTTP status lets a failure through as a success. ALWAYS check `error === false` before reading `data`.

2. **`balance`, `tax` and `extra_charges.total` are STRINGS in Brazilian format — and the format varies between APIs.**
   Values seen in the catalog: `"154,380"`, `"497,84"`, `"0,000"` and `"0.19"`. Comma in some, dot in another; three decimal places in some, two in another. In JavaScript, `parseFloat("154,380")` returns `154` and drops the cents with no error at all, and `Number("154,380")` returns `NaN`. Write a converter that handles both separators, and never use these fields in a financial decision without converting them.

3. **Every call costs money.**
   Blind retries multiply the bill. Never automatically repeat a 4xx: a bad parameter repeated is still bad, and still charged. Retry only timeouts and 5xx, with exponential backoff and a small attempt ceiling.

4. **HTTP 402 means insufficient balance, and retrying does not fix it.**
   It is the one status that needs a human — a top-up. Treat it as a terminal error with its own message, and do not lump it in with generic 4xx.

5. **`extra_charges` bills on top of the lookup price.**
   When the body asks for add-on services, the response lists each one with its price plus a `total` that is NOT included in the base amount. If you show cost to an end user, add both.

## See also

- OpenAPI specification: https://doc.apibrasil.io/apis/creditos/b1508a3-bc08-12ef-becf-000c29865f118/openapi.json
- API catalog: [API catalog](https://doc.apibrasil.io/apis.md)
- Official SDKs: [Official SDKs](https://doc.apibrasil.io/sdks.md)
- Documentation index: https://doc.apibrasil.io/llms.txt
- HTML version of this page: https://doc.apibrasil.io/apis/creditos/b1508a3-bc08-12ef-becf-000c29865f118