# CrazyPIN (Beta) - SMS One-Time Passcodes (OTP) for Australian Mobiles | Crazytel

> Canonical URL: https://crazytel.com.au/crazypin/
> MyAccount Portal: https://myaccount.crazytel.com.au/crazypin/
> REST API Documentation: https://crazytel.io/docs#/CrazyPIN%20SMS%20Verification

CrazyPIN sends a six-digit one-time passcode (OTP) to an Australian mobile and checks the code your customer types back. Use it for signups, logins, password resets, phone number changes and high-value transactions, all through one simple REST API.

## Highlights

- Six-digit codes with a five-minute default expiry (2 to 10 minutes per profile).
- Sent from your own Australian mobile number or an approved SMS sender name.
- No extra fee for checking a code. No monthly fee.
- Daily SMS budget per application, per-mobile sending and guessing limits.
- Safe retries with idempotency keys.
- Australian mobiles only. Currently in beta.

## Why CrazyPIN

- **Your number, your brand**: Codes come from a mobile number on your account or an approved SMS sender name. The message names your business using the brand name you choose.
- **Built-in spending protection**: Every application has its own daily SMS budget (resets midnight AEST). Sending stops when the budget is reached. Per-mobile limits stop one phone being flooded, and wrong guesses are limited.
- **Safe to retry**: Repeating a request with the same `Idempotency-Key` returns the original result instead of sending a second SMS or counting a second guess.
- **Honest status**: SMS delivery (submitted, delivered, failed) and code confirmation (pending, approved, attempts remaining) are tracked separately.
- **Nothing sensitive in responses**: Responses show a masked mobile number and never include the code.

## How It Works

1. **Choose a sender**: An active Australian mobile number on your account or an approved SMS sender name.
2. **Create an application profile**: Set SMS brand name, code lifetime (2 to 10 minutes), wrong-guess limit (3 to 5) and daily SMS budget. New profiles start switched off.
3. **Send a code**: `POST /verifications` with the mobile number and purpose (signup, login, password reset, phone change or transaction).
4. **Check the code**: `POST /verifications/{id}/checks`. A correct code returns `valid: true` once.

## Features

- Six-digit codes, leading zeros preserved, only the newest code works, a correct code can be used once.
- Configurable lifetime: 2 to 10 minutes (5 by default). Resending never restarts the clock.
- Wrong-guess limit: 3 to 5 attempts per verification, counted across resends.
- Resend and cancel: up to three SMS per verification, with a short wait between sends.
- Purpose labels so a code only completes the action it was created for.
- Daily SMS budget per profile, resets at midnight AEST.
- Per-mobile protection across all your profiles.
- Idempotent requests for sends, resends and checks.
- 30-day status history and live delivery status.
- Portal Test Verification tool in MyAccount.

## Developer Quick Start

- Base URL: `https://api.crazytel.io/api/v1/verify`
- Authentication header: `x-crazytel-api-key: your_api_key` (MyAccount, CrazyPIN, API Management)

Send a code:

```bash
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications" \
  -H "x-crazytel-api-key: your_api_key" \
  -H "Idempotency-Key: a-new-unique-value-for-each-send" \
  -H "Content-Type: application/json" \
  -d '{
    "profile_id": "YOUR_PROFILE_ID",
    "to": "0491570006",
    "channel": "sms",
    "purpose": "signup",
    "reference": "your-flow-reference"
  }'
```

Check the code:

```bash
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications/VERIFICATION_ID/checks" \
  -H "x-crazytel-api-key: your_api_key" \
  -H "Idempotency-Key: a-different-unique-value-for-this-check" \
  -H "Content-Type: application/json" \
  -d '{"code": "012345"}'
```

Example response:

```json
{
  "id": "44444444-4444-4444-8444-444444444444",
  "status": "approved",
  "valid": true,
  "to_masked": "+614*****006",
  "purpose": "signup",
  "check_attempts_remaining": 5,
  "expires_at": "2026-10-21T04:05:00Z",
  "verified_at": "2026-10-21T04:01:12Z"
}
```

Mobile numbers can be written as `04xxxxxxxx`, `614xxxxxxxx` or `+614xxxxxxxx`. Keep codes as text so leading zeros survive.

## Use Cases

Account signup, two-step login, password reset, changing a phone number, confirming a payment or booking, cleaning up lead lists.

Safety note: owning a mobile number does not prove who someone is. Do not use an SMS code on its own to approve sensitive account recovery or to establish legal identity.

## Pricing

- No monthly fee and no separate verification fee.
- You pay your normal Crazytel SMS price for each message sent, including resends (5c per standard SMS on pay-as-you-go).
- **Checking a code is free.**
- Crazytel Bulk SMS plans (from $19.95/month) are available from the SMS Center in MyAccount. See https://crazytel.com.au/business/sms/
- Failed delivery, expired codes, cancelled verifications and wrong codes are not refunded.

## FAQ

- **Which phones can I send to?** Australian mobile numbers only for now.
- **How long does a code last?** Five minutes by default, 2 to 10 minutes per profile.
- **Can I resend?** Yes, up to three SMS per verification. A resend replaces the old code but does not extend the expiry or give back wrong guesses.
- **How many wrong guesses?** Between three and five, set per profile.
- **Can the SMS wording be changed?** No. It is a fixed message naming your SMS brand, the code and the time left.
- **Is the code visible anywhere?** In the SMS itself (so in your SMS history). Never in API responses.
- **Is it production ready?** CrazyPIN is in beta. Features and limits may change.

Get started: https://myaccount.crazytel.com.au/crazypin/