标签：#sms

Short answer: Choose an SMS API for critical outage alerts only if your backend can poll delivery status and own retry, escalation, cancellation, and timing logic; for restaurant waitlist updates, treat the provider as a delivery transport rather than as the incident workflow itself. The deciding constraint is delivery reliability. Sending a message is the easy part; deciding whether an unresolved alert should be polled again, resent, escalated through another channel, or canceled after recovery is where the application earns its reliability. An API that can send, expose status and events, resend, and cancel covers those transport mechanics. Without webhook pushes, however, the backend must run polling frequently enough for its actual alert deadline. This is a conditional yes, not a blanket recommendation. Timing dominates. How should you choose an SMS API for critical outage alerts? Start with an explicit service-level objective for the restaurant workflow. A waitlist delay notice might tolerate a polling interval that a critical app outage alert cannot. Write down the maximum time from initial send to the next decision, the point at which another attempt becomes stale, and the moment when recovery must suppress queued or repeat messages. If those values are missing, comparing provider feature lists produces a confident-looking choice with no reliability argument behind it. Four invariants matter here. Every accepted send needs an application-owned identifier; every retry must be bounded and idempotent; every delivery state must lead to a defined next action; and incident recovery must stop obsolete alerts. SMS cancel support helps with the last invariant, but cancellation is not permission to ignore timing: the application still has to notice recovery and issue the decision promptly. There is a hard boundary. No webhook event push means that delivery updates arrive only when the application asks for them, so a ten-second polling job cannot support a five-second es

Short answer: use an emailed, single-use reset link as the default for most SaaS login recovery, and add SMS OTP only where users may genuinely lack email access or the product already maintains verified phone numbers. Email is usually the simpler system because the login identifier, recovery destination, and support workflow can remain in one channel. SMS can shorten the interaction, but it adds phone-number lifecycle, message segmentation, regional consent, and delivery-state work. “Cheaper” depends on your traffic and failure rates, so model completed recoveries rather than message sends. This is a recovery decision, not a notification preference. The goal is to return the right person to an account without turning a delayed message, an expired credential, or a recycled phone number into an account takeover or a support queue. I've worked around enough spam filtering, rate limiting, and OTP delivery gaps to treat the channel as one component of that system — never as the system itself. What should a SaaS password recovery flow use: email API or SMS OTP? Start with the account data you can already trust. If every user signs in with an email address and changing that address is a controlled operation, an email reset link creates the smaller data surface. The service generates a high-entropy, single-use token, stores only a protected representation of it, sends a link, and accepts that token once before a short expiry. The browser then moves the user into a password-change session. An SMS OTP flow looks compact on screen, yet the backend has more questions to answer. Was the phone number verified recently? Can the user update it without being signed in? How are country codes normalized? What happens when a number is reassigned? Does the support team have a safe path for a person who lost the device? A six-digit form doesn't make those policy decisions disappear. So the default is straightforward. Choose email first when email is the stable account identifier and rec

Short answer: model each SMS OTP as an auditable challenge that can be consumed once, and make the server—not the mobile screen—the authority for expiry, autofill acceptance, repeat-request limits, and recipient suppression. Those decisions belong in the security contract before a messaging adapter is selected. The concrete problem is deceptively small: a mobile user asks for a code, the app receives a text, and the user signs in. In production, the same endpoint is also a spending endpoint, a privacy boundary, and a fraud signal. A duplicate tap, a delayed carrier message, or a recycled phone number can turn a pleasant login flow into an account-enumeration or SMS-bombing incident. I approach this like a ledger. Every state transition needs an idempotency key, an audit record, and a clear owner. Seven invariants keep the design reviewable. Stop. Consent, retention, and privacy records The server creates a challenge with a random, short-lived code, stores only a salted hash, and binds the challenge to a normalized recipient plus a login intent. The client receives an opaque challenge identifier; it never decides whether a code is valid. Verification consumes the challenge atomically, so two concurrent requests cannot both win. A resend is a new delivery attempt on the same login intent, subject to a cooldown and a rolling budget. It must not silently invalidate a code that is already in transit unless the product explicitly documents that behavior. Suppression is checked before dispatch and again when delivery feedback is ingested. That second check matters for bounces, reassigned numbers, and manually blocked recipients. Option Strength Cost or boundary One service owns challenge and delivery state Simple audit trail and exactly-once verification Requires a durable store and transactional writes Separate identity and messaging services Teams can deploy independently Correlation IDs and replay rules cross a network boundary Client-generated code or expiry Fast proto

An e-commerce alert is not complete when an API accepts a message. It is complete when the application records a terminal delivery state, suppresses an invalid recipient, or escalates through a separately governed channel. Short answer: use a dedicated SMS API for a small critical-alert worker when template ownership and direct status control matter; keep AWS SNS when SMS belongs inside an existing cloud messaging stack, and prefer a callback-capable provider when escalation must begin in under a minute. That choice creates work. A direct API keeps the send path narrow, but polling, retries, dead-letter handling, and country-specific fallback rules remain application responsibilities. For critical alerts, those responsibilities need the same idempotency and audit discipline as a ledger entry: one intent, one durable identifier, and an append-only record of every state observation. No provider turns carrier delivery into exactly-once delivery. Implement the template control plane in Node.js Start with the contract, not the vendor. The application owns an immutable alert intent containing the business event ID, recipient, template version, jurisdiction, and escalation deadline. Template ownership is the decision axis: if compliance reviewers must approve and reproduce the exact text that was sent, keep the canonical template version in the application and treat a provider template ID as deployment metadata. If a provider must own localization or regulatory registration, record that provider template ID beside the application version rather than letting it become invisible configuration. A useful state machine separates accepted from a terminal delivery result. Persist the provider message ID after the initial send, schedule periodic status reads, and append each observation with its timestamp and request ID. A retry after HTTP 429 is transport recovery, not permission to create a second alert; honor Retry-After , use exponential backoff, and preserve the same idempote

Treat an SMS timeout as an unknown outcome, not a failed send: accept each password-reset event once, persist its expiry and idempotency key before dispatch, and retry only through a worker that can reconcile the original attempt. For a short-lived e-commerce reset token, compliance evidence is the deciding constraint. The system must be able to show what it accepted, what it attempted, when it stopped, and why, without storing the token or message body in an audit log. This changes the shape of the endpoint. A Node.js Express handler may receive the event, but it shouldn't hold the HTTP request open while an SMS provider decides the final delivery state. Return an accepted response after durable admission, then expose status from local state. The Go example below shows the same transport-independent contract because the hard part isn't an Express API call; it's controlling ownership of retries. One event, one logical notification. How should event notifications handle SMS timeout, retry, and duplicate sends? Use two identifiers with different jobs. event_id identifies the business action, such as one password-reset request. idempotency_key identifies the logical notification command. A unique constraint on the key makes two concurrent HTTP requests converge on one stored record; checking memory before an insert is not enough because two processes can pass that check together. A timeout leaves three possible realities: the provider never accepted the request, it accepted the request but the response was lost, or it accepted and sent the message before the caller stopped waiting. Retrying immediately as though the first case were certain is how customers receive two reset messages. Declaring success is no better. The durable record should therefore enter dispatch_unknown , keep the provider's attempt identifier when one exists, and move through reconciliation before another send can be authorized. Status polling serves a different purpose from retry. Polling reads th

Support SMS inboxes are usually a routing problem before they are an AI problem. Someone asks about billing. Someone else needs technical support. A third person wants to talk to sales. The app has to understand the message, pick the right destination, reply to the customer, and remember what happened. This TypeScript example does that on Telnyx Edge Compute with the Agent SDK. Code: https://github.com/team-telnyx/telnyx-code-examples/tree/main/agent-sms-triage-bot What it builds agent-sms-triage-bot receives inbound SMS webhooks, classifies each message into one of four topics, looks up the route for that topic, replies by SMS, and stores triage history in durable actor state. The topics are: billing support sales general The default route table maps those topics to queue names: billing -> billing-queue support -> support-queue sales -> sales-queue general -> general-queue The request flow Inbound SMS -> POST /webhooks/sms -> TriageAgent.triage(from, text) -> Telnyx AI Inference classifies topic -> durable route table lookup -> SMS reply -> triage history update The app uses one TriageAgent actor per inbound number. That actor stores route rules, recent history, total messages, and topic counts. The main routes POST /webhooks/sms receives Telnyx message.received events POST /debug/triage simulates inbound SMS POST /routes updates the route table GET /routes lists route rules GET /history returns recent triage history GET /debug/state inspects actor state GET /health/liveness and GET /health/readiness provide health checks The Agent SDK piece The core class is TriageAgent . It extends the Agent SDK Agent class and uses durable state for: route table triage history total message count topic counts The AI classification call uses the Telnyx binding: const completion = await this . env . TELNYX . ai . openai . chat . createCompletion ({ model : this . env . AI_MODEL || " moonshotai/Kimi-K2.6 " , messages : [ { role : " system " , content : CLASSIFY_SYSTEM_PROMPT }, { r

Instacart redesigned its personalized marketing system using a configuration-driven multi-tenant architecture on Storefront Pro. The system replaces retailer-specific implementations with a shared execution engine, enabling scalable personalization, faster configuration propagation in under a minute, and 99.9% delivery success across hundreds of retail banners through a unified campaign platform. By Leela Kumili

We’re a tiny team of 2–9 engineers who believe business messaging should be simple, reliable, and accessible to everyone. Today we’re officially opening up BulkSMSOnline to the Dev.to community, and we’d love your feedback. What’s BulkSMSOnline? A global bulk SMS platform that lets you send campaigns, alerts, OTPs, and notifications via: A clean web portal A REST API An HTTP API It’s designed for developers who want reliable global delivery without fighting arcane telecom protocols or opaque pricing. Why We Built It We noticed a pattern: most SMS platforms either overcomplicate things with bloated SDKs or hide behind enterprise gatekeepers that don’t listen. We wanted something different a lean, transparent API backed by real people who actually care about your deliverability. So we built BulkSMSOnline around three principles: Reliability : Messages must arrive, every time. Radical simplicity : A clean API you can integrate in minutes. Transparency : Honest pricing, clear limits, no surprises. Quick Start: Send an SMS in Under 5 Minutes Here’s how simple it is with our REST API. For full docs, check out our developer portal . curl -X POST https://api.bulksmsonline.com/v1/sms \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "to": "+1234567890", "message": "Hello from BulkSMSOnline!", "sender": "MyApp" }' You’ll get a JSON response with a message ID and status. That’s it. No multi-page setup or carrier negotiations. What else can you do? Send bulk messages with a single API call Track delivery in real time via webhooks Pull reports programmatically Use our HTTP API for legacy systems Who’s Behind This? We’re a small, agile team (2–9 people). That means: No bureaucracy: Fixes and features ship fast. Direct access: When you email support, you reach the engineers who built the platform. Your feedback shapes our roadmap: Many of our recent features came from developer conversations. Tech stack we love: Python, Node.js, PostgreSQL, an

We run Quackr, a virtual phone number platform that lets developers and individuals receive SMS verifications without exposing a real number. We just published our first inventory transparency report and the data was surprising enough that we thought the dev community would find it useful. The Numbers Right now, 97.6% of our entire virtual phone number inventory is actively rented. 66,214 out of 67,815 numbers assigned and in use across 15+ countries. Over 1,000 numbers available at any given moment but they move fast. That utilisation rate tells you something about how the market has shifted. Virtual numbers are no longer a niche throwaway tool. Developers, businesses, and privacy-conscious users are holding them long term. What Developers Actually Use Virtual Numbers For The obvious use case is SMS verification during testing. Spin up a number, verify an account in staging, move on. But that is not what drives the bulk of demand on our platform. The real volume comes from: Multi-account management — developers and businesses running multiple instances of platforms that require unique phone verification per account. Privacy layers in production apps — applications that need to verify users without collecting their real numbers. A virtual number sits between the user and the platform. Automated verification pipelines — this is where our API and MCP Server come in. If you need to provision numbers programmatically and retrieve OTPs without manual intervention, this is the use case we built for. Geographic flexibility — needing a UK number from Australia, a US number from Ukraine, or any combination that your real SIM cannot provide. The OTP Blocking Problem Something worth knowing if you are building anything that involves SMS verification: platform-level VoIP blocking has become significantly more aggressive over the past two years. WhatsApp, Telegram, Google, and TikTok all run detection on incoming verification requests. A VoIP number gets flagged and the OTP simp