Developers

Predictable API, predictable errors.

Bearer authentication, one error shape, a request id on every response and signed webhooks you can verify in four lines.

Open documentation

Authentication and limits

Send your key as Authorization: Bearer bsk_live_…
Keys are stored hashed — the raw value is shown once at creation
Each key carries its own per-minute request limit
Repeated sends to the same number are throttled independently of the key limit
Every response carries a request_id you can quote to support

Error shape

{
  "success": false,
  "error": { "code": "RATE_LIMITED", "message": "Rate limit exceeded. Slow down and retry." },
  "request_id": "REQ_4c1f9ab2d0e7"
}

Webhooks

Delivery

POST /your/endpoint
x-blacksms-signature: sha256=6f1c...
Content-Type: application/json

{
  "event": "message.delivered",
  "data": { "message_id": "MSG_8f21c0d43a9b1e77", "to": "919876543210", "status": "delivered" },
  "timestamp": "2026-02-11T09:14:22.481Z"
}

Verify (Node.js)

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const received = (header ?? "").replace("sha256=", "");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}