Limits and fixes for CrazyPIN SMS one-time passcodes (OTP): code lifetime, wrong-guess attempts, resend rules, per-mobile send limits, daily SMS budget, and what to do when a code does not send, has expired, or the verification is locked. Includes security tips for your API key and codes.
Limits and rules
| Rule | Detail |
|---|---|
| Destinations | Australian mobiles only |
| Code | 6 digits. Only the newest code works. A correct code can be used once. |
| Lifetime | 2 to 10 minutes (default 5) |
| Wrong guesses | 3 to 5 per verification, counted across resends |
| Resends | Up to 3 SMS per verification. Wait 30 seconds before the first resend and 60 seconds before the last. Not available in the final 30 seconds. |
| Per mobile number | 3 sends in 10 minutes and 10 in 24 hours, across all your profiles |
| Code guesses | Limited per mobile number (10 per 10 minutes, 30 per hour) |
| Daily budget | Per profile. Includes messages still being sent. Resets at midnight AEST (UTC+10). |
| Status history | 30 days |
Troubleshooting
| What you see | What it means and what to do |
|---|---|
| No caller ID can send SMS yet | You have no caller ID that can send SMS. Add a mobile number or request an approved SMS sender name under Caller ID. |
| A caller ID shows (cannot send SMS yet) | It is not approved for SMS. Pick another or finish its approval. |
| Profile is disabled | Open Manage and switch Enable profile on. |
| A profile or account SMS budget has been reached | The daily budget is used up. Raise it (profile settings) or wait until midnight AEST. |
| The mobile number has reached its SMS send limit | That number received too many codes. Wait for the retry time shown. |
| Too many verification requests | Slow down and honour the Retry-After time. |
| This code has expired | Start a new verification. Resending does not extend expiry. |
| No code attempts remain | The verification is locked. Start a new one. |
| The SMS may already have been submitted (timeout) | Do not send again with a new key. Retry the same request with the same key, or look the verification up. |
| There is not enough account balance | Top up your account balance and try again. |
| Not enough permission / account could not be resolved | Sign in with the main customer account. Contact support if it continues. |
401 or 403 from the API | The API key is missing, wrong or was regenerated. Check the x-crazytel-api-key header. |
Security tips
- Keep your API key on your server and rotate it if you think it has leaked.
- The SMS (including the code) is stored in your normal SMS history. Limit who can view it. API responses never include the code.
- Owning a mobile number does not prove who someone is. Do not use an SMS code on its own to approve sensitive account recovery.
- Keep your daily SMS budget as low as is practical.
Getting help
Use the Support Desk in MyAccount and include the request_id from any API error, or call 1800 272 998.