Skip to main content
  • CALLS TO AUSTRALIAN
    MOBILES FROM 5 CENTS!
  • Free $5 Sign Up
    Bonus!
  • Instant Setup
    on all SIP Trunks!
  • We are Aussies! :
    Australian Owned & Operated
  • Beta
  • SMS one-time passcodes
  • Australian mobiles

CrazyPINConfirm it's really them, with one SMS

CrazyPIN sends a six-digit one-time passcode (OTP) to an Australian mobile and checks the code your customer types back. Use it for signups, logins, password resets, phone number changes and high-value transactions, all through one simple API.

5¢ / SMS sent
Checking a code is free
No monthly fee · normal Crazytel SMS rate
  • Six-digit codes, five-minute default expiry
  • Sent from your own number or approved sender name
  • No extra fee for checking a code
  • Daily SMS budget per application
  • Safe retries built in
  • Australian mobiles only
Get started in MyAccount API documentation

Why CrazyPIN

A verification step should protect your customers and your SMS bill. CrazyPIN is built around both.

Built-in spending protection

Every application gets its own daily SMS budget. If a bot or a bug starts firing off codes, sending stops when the budget is reached. Per-mobile limits stop one phone number being flooded with codes, and wrong guesses are limited so codes cannot be brute-forced.

  • Your number, your brand

    Codes are sent from a mobile number on your account or an approved SMS sender name, so customers see a sender they recognise. The message names your business, using the brand name you choose.

  • Safe to retry

    Networks time out. CrazyPIN uses idempotency keys, so repeating a request after a timeout returns the original result instead of sending a second SMS or counting a second guess.

  • Honest status

    Sending an SMS and confirming a code are tracked separately. Your application always knows whether the message was submitted, delivered or failed, whether the code is still pending, and how many attempts remain.

  • Nothing sensitive in responses

    API responses show a masked mobile number and never include the code itself.

How it works in 4 steps

Set up once in MyAccount, then two API calls per verification.

  1. Choose a sender

    Pick an active Australian mobile number on your account or an approved SMS sender name.

  2. Create an application profile

    Set your SMS brand name, how long codes last (two to ten minutes), how many wrong guesses are allowed (three to five) and a daily SMS budget. New profiles start switched off so nothing sends until you are ready.

  3. Send a code

    Your server calls POST /verifications with the mobile number and what the code is for: signup, login, password reset, phone change or transaction.

  4. Check the code

    When your customer types the six digits, your server calls POST /verifications/{id}/checks. A correct code returns valid: true once, and your application completes the original action.

Developer quick start

Two requests: send a code, then check it. Find your API key in MyAccount under CrazyPIN, API Management.

Base URL https://api.crazytel.io/api/v1/verify
Authentication header x-crazytel-api-key: your_api_key
1. Send a code 
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications" \
  -H "x-crazytel-api-key: your_api_key" \
  -H "Idempotency-Key: a-new-unique-value-for-each-send" \
  -H "Content-Type: application/json" \
  -d '{
    "profile_id": "YOUR_PROFILE_ID",
    "to": "0491570006",
    "channel": "sms",
    "purpose": "signup",
    "reference": "your-flow-reference"
  }'
2. Check the code 
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications/VERIFICATION_ID/checks" \
  -H "x-crazytel-api-key: your_api_key" \
  -H "Idempotency-Key: a-different-unique-value-for-this-check" \
  -H "Content-Type: application/json" \
  -d '{"code": "012345"}'
Example response 
{
  "id": "44444444-4444-4444-8444-444444444444",
  "status": "approved",
  "valid": true,
  "to_masked": "+614*****006",
  "purpose": "signup",
  "check_attempts_remaining": 5,
  "expires_at": "2026-10-21T04:05:00Z",
  "verified_at": "2026-10-21T04:01:12Z"
}
  • Mobile numbers can be written as 04xxxxxxxx, 614xxxxxxxx or +614xxxxxxxx.
  • Keep codes as text so leading zeros survive. 012345 is not 12345.
  • Use a new Idempotency-Key for each send and each check. Repeat the same key only to retry a timed-out request.
  • Not ready to code? Use Test Verification in MyAccount to send a real code to your own mobile.
  • Full endpoint reference in the CrazyPIN API docs.

Features

Everything a verification step needs, and nothing that adds to your bill.

FeatureDetails
Six-digit codesLeading zeros preserved. Only the newest code works, and a correct code can be used once.
Configurable lifetime2 to 10 minutes per profile (5 minutes by default). Resending never restarts the clock.
Wrong-guess limit3 to 5 attempts per verification, counted across resends.
Resend and cancelUp to three SMS per verification, with a short wait between sends. Cancel a pending code at any time.
Purpose labelsSignup, login, password reset, phone change or transaction, so a code can only complete the action it was created for.
Daily SMS budgetSet a per-profile ceiling. Resets at midnight AEST.
Per-mobile protectionSending and guessing limits apply across all your profiles for each mobile number.
Idempotent requestsRetry timed-out sends, resends and checks safely with an Idempotency-Key.
30-day status historyLook up any verification for 30 days.
Live delivery statusSee whether the SMS was submitted, delivered or failed.
Portal test toolSend a real test code and check it from MyAccount before you write a line of code.

Where businesses use it

Anywhere you need to know the person has the phone in their hand.

  • Account signup

    Confirm a new customer owns the mobile number they entered.

  • Two-step login

    Add a second step to your own app's login.

  • Password reset

    Send a code before allowing a reset (see the safety note below).

  • Changing a phone number

    Confirm the new number belongs to the customer before it replaces the old one.

  • Confirming a payment or booking

    Add a quick check before a high-value transaction.

  • Cleaning up lead lists

    Make sure the mobile on a form is real and reachable.

Safety note: owning a mobile number does not prove who someone is. Don't use an SMS code on its own to approve sensitive account recovery or to establish legal identity.

Pricing

CrazyPIN has no monthly fee and no separate verification fee. You pay your normal Crazytel SMS price for the messages you send.

$0 Monthly fee, and no separate verification fee
5¢ Per standard SMS sent on pay-as-you-go, including resends
Free Checking a code, every time
  • Sending a lot of codes? Crazytel Bulk SMS plans, from $19.95 per month, are available from the SMS Center in MyAccount. See the SMS platform page for the full rate table.
  • Failed delivery, expired codes, cancelled verifications and wrong codes are not refunded.
  • Test Verification in MyAccount sends a real code, so normal SMS charges apply.

Frequently asked questions

Practical answers about codes, limits, sender names and pricing.

Which phones can I send to?
Australian mobile numbers only for now. You can write them as 04xxxxxxxx, 614xxxxxxxx or +614xxxxxxxx.
How long does a code last?
Five minutes by default. You can set between two and ten minutes per profile.
Can I resend a code?
Yes. Up to three SMS can be sent per verification. A resend replaces the old code immediately but does not extend the expiry or give back wrong guesses.
How many wrong guesses are allowed?
Between three and five, set per profile. After that the verification locks.
What does the SMS say?
A fixed message that names your SMS brand, shows the code and states how long it has left. You cannot edit the wording.
Can I send from my own number?
Yes. Use an active Australian mobile number on your account or an approved SMS sender name, so customers see a sender they recognise.
What stops someone running up my SMS bill?
Each profile has a daily SMS budget, each mobile number has sending limits, and new profiles start switched off. If a bot or a bug starts firing off codes, sending stops when the budget is reached.
Is the code visible anywhere?
The code is in the SMS itself, so it appears in your normal SMS history. API responses never include it, so restrict who can see that history.
Can I try it before building anything?
Yes. Use Test Verification in MyAccount to send a real test code to your own mobile and check it. Normal SMS charges apply.
Is it ready for production?
CrazyPIN is in beta. Features and limits may change as we learn from customers.

Start verifying in minutes

Create a profile, send a test code to your own phone, then connect your application.

Open CrazyPIN in MyAccount Read the API docs
Need Help?