Connect your website or app to CrazyPIN, the Crazytel SMS one-time passcode (OTP) verification API. Get your API key in MyAccount, send a six-digit code to an Australian mobile, check the code the customer enters, and retry safely with idempotency keys. All calls are made from your server.
Set up a profile first: see CrazyPIN SMS one-time passcodes - setup. Full technical reference: https://crazytel.io/docs#/CrazyPIN%20SMS%20Verification.
1. Get your API key
Go to Premium Features > CrazyPIN > API Management. Click Show to reveal your key, or Copy to copy it.
- Keep the key on your server only. Never put it in a web page, mobile app, screenshot or support ticket.
- Regenerate key creates a new key and the old one stops working immediately. Update your servers first or straight after.
- The key is shared by every Crazytel API product on your account, including SMS.
2. Make API calls from your server
| Setting | Value |
|---|---|
| Base URL | https://api.crazytel.io/api/v1/verify |
| Authentication header | x-crazytel-api-key: your_api_key |
| Format | JSON (Content-Type: application/json) |
| Full documentation | https://crazytel.io/docs#/CrazyPIN%20SMS%20Verification |
| Method | Path | Purpose |
|---|---|---|
GET | /senders | List caller IDs you can send from |
POST | /profiles | Create a profile (starts disabled) |
GET | /profiles and /profiles/{profile_id} | List or read profiles |
PATCH | /profiles/{profile_id} | Change settings, enable or disable |
POST | /verifications | Send a code |
GET | /verifications/{id} | Read status |
POST | /verifications/{id}/checks | Check a code |
POST | /verifications/{id}/resend | Send a fresh code |
POST | /verifications/{id}/cancel | Cancel a pending verification |
3. The normal flow
Step A. Send a code
Send a code when the customer asks for one:
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications" \
-H "x-crazytel-api-key: your_api_key" \
-H "Idempotency-Key: 6f1c2b7e-unique-per-send" \
-H "Content-Type: application/json" \
-d '{
"profile_id": "YOUR_PROFILE_ID",
"to": "0491570006",
"channel": "sms",
"purpose": "signup",
"reference": "signup-flow-001"
}'tocan be04xxxxxxxx,614xxxxxxxxor+614xxxxxxxx.purposeis one ofsignup,login,password_reset,phone_change,transaction.referenceis an ID your own backend creates for this flow. Do not put personal details or secrets in it.- The response includes an
id. Store it with your flow, because you need it to check the code.
Step B. Check the code
Check the code when the customer enters it:
curl -X POST "https://api.crazytel.io/api/v1/verify/verifications/VERIFICATION_ID/checks" \
-H "x-crazytel-api-key: your_api_key" \
-H "Idempotency-Key: 9d84a0c1-unique-per-check" \
-H "Content-Type: application/json" \
-d '{"code": "012345"}'- Send the code as text so leading zeros stay.
valid: trueandstatus: "approved"means the code was correct.valid: falsewith fewercheck_attempts_remainingmeans a wrong code. After the last wrong guess you will getverification_attempts_exhausted.
Step C. Finish the original action once
Only the first successful check may complete your signup, login or other action. Make that step atomic on your side. Status lookups, delivery receipts and repeated successful checks are not new approvals.
4. Idempotency keys (safe retries)
Send a unique Idempotency-Key header (8 to 255 printable characters, no spaces) with every send, resend and check. If a request times out, repeat the same request with the same key and body. You will get the saved result and nothing happens twice. Keep keys for at least 24 hours. Never use a new key just because you did not get a response: the SMS may already have been sent.
5. Show a countdown correctly
Use expires_at from the response for your countdown, not the time you sent the SMS. Messages can arrive late. Resending does not restart the timer.