Public REST API v1

Integrate DS SMS HUB virtual numbers (Servers 1–6) with hashed API keys, scopes, rate limits, and idempotent purchases.

Open Developer Center

Authentication

• Create a Public API key in the dashboard (shown once; stored hashed).
• Send Authorization: Bearer <raw_key> on every request.
• Scopes: balance:read, numbers:read, numbers:buy, orders:read, orders:cancel.

Response envelope

{
  "success": true,
  "message": "OK",
  "data": { },
  "request_id": "…"
}

Every response includes X-Request-ID and Cache-Control: no-store.

Endpoints

Method	Path	Scope
GET	/balance	balance:read
GET	/otp/servers	numbers:read
GET	/otp/countries?server=	numbers:read
GET	/otp/services?server=&country=	numbers:read
GET	/otp/price?server=&service=&country=	numbers:read
POST	/otp/orders	numbers:buy
GET	/otp/orders/{id}	orders:read
POST	/otp/orders/{id}/cancel	orders:cancel

Buy a number

Requires header Idempotency-Key. Body fields: server (1–6), service, optional country, optional service_name. Client-supplied price / user_id / status are ignored.

curl -X POST "https://dssmshub.com/api/v1/otp/orders" \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Idempotency-Key: unique-request-id" \
  -H "Content-Type: application/json" \
  -d '{"server":1,"service":"whatsapp","country":"1"}'

Get OTP

curl "https://dssmshub.com/api/v1/otp/orders/12345" \
  -H "Authorization: Bearer YOUR_KEY"

Cancel & refund

Refunds run only after the upstream server confirms cancel or the order is already closed/expired. Local wallet credit uses a single lock (no double refund).

Servers

• Server 1 (USA Only)
• Server 2 (Global & USA)
• Server 3 (USA Premium)
• Server 4 (Global)
• Server 5 (USA Only)
• Server 6 (Global & USA)

Developer webhook

When an OTP arrives, we POST JSON to your webhook URL:

{
  "order_id": 12345,
  "number": "+1…",
  "sms_code": "123456",
  "service": "WhatsApp",
  "server": 1,
  "server_label": "Server 1",
  "received_at": "2026-10-01T12:00:00+00:00"
}

Verify X-DSS-Signature: sha256=<hmac> where HMAC-SHA256 is computed over timestamp + "." + raw_body using your webhook secret (X-DSS-Timestamp header).

Rate limits

• 60 requests/min per key (global)
• 10/min purchase · 10/min cancel · 30/min poll / catalog / balance
• HTTP 429 with Retry-After when exceeded

HTTPS

Use HTTPS in production. Never commit API keys or webhook secrets.