Add secure SMS OTP two-factor authentication to your application. Three endpoints: Send OTP, Verify OTP, and Check Balance — all returning JSON.
https://www.isms.com.my/2FA/request.php. The OTP is a 6-digit random number. The %OTP% placeholder in your message template is automatically replaced with the generated OTP.uuid + sms_id in response → user enters OTP → Verify OTP with those IDs → allow or deny access.Sends a 6-digit OTP to the specified mobile number via SMS.
https://www.isms.com.my/2FA/request.php| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| un | String | Required | iSMS account username | myuser |
| pass | String | Required | iSMS account password | mypass |
| mobile | Integer | Required | Mobile number without country code and without leading 0 — e.g. 1XXXXXXXXX | 1XXXXXXXXX |
| country_code | Integer | Required | Country calling code — e.g. 60 for Malaysia | 60 |
| message | String | Required | SMS message template. Use %OTP% as placeholder — it is replaced with the 6-digit OTP automatically. | Your OTP code is %OTP% |
| type | Integer | Required | 1 = ASCII (English/BM) · 2 = Unicode (Chinese/Arabic) | 1 |
| sendid | String | Optional | Sender ID — alphanumeric, max 11 characters | MyApp |
https://www.isms.com.my/2FA/request.php?un=myuser&pass=mypass&mobile=1XXXXXXXXX&country_code=60&type=1&sendid=MyApp&message=Your+OTP+Code+is+%25OTP%25<?php
$params = http_build_query([
'un' => 'myuser',
'pass' => 'mypass',
'mobile' => '1XXXXXXXXX', // No country code, no leading 0
'country_code' => '60',
'message' => 'Your OTP code is %OTP%', // %OTP% auto-replaced
'type' => '1',
'sendid' => 'MyApp',
]);
$ch = curl_init('https://www.isms.com.my/2FA/request.php?' . $params);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$result = curl_exec($ch);
$error = curl_error($ch);
curl_close($ch);
if ($error) { die('cURL error: ' . $error); }
$data = json_decode($result, true);
if ($data['status'] === 'Success') {
// Store $data['uuid'] and $data['sms_id'] — needed for verification step
$uuid = $data['uuid'];
$sms_id = $data['sms_id'];
echo 'OTP sent! UUID: ' . $uuid;
} else {
echo 'Failed: ' . ($data['message'] ?? $result);
}{
"status": "Success",
"code": "147623",
"uuid": "bd9a1ff0-4f2c-11eb-9b62-008cfaff44de",
"username": "myuser",
"sms_id": "1171081025",
"mobile": "+601X-XXXXXXX"
}{
"status": "Failed",
"message": "Authentication Failed",
"uuid": "1a1e1b86-...",
"sms_id": "1171081605",
"code": "408902",
"mobile": "+601X-XXXXXXX"
}| Response Field | Description |
|---|---|
| status | Success or Failed |
| code | The 6-digit OTP that was sent (store securely for reference) |
| uuid | Unique message identifier — required for the Verify OTP call |
| sms_id | SMS transaction ID — required for the Verify OTP call |
| mobile | Destination mobile in international format |
| username | Your iSMS account username |
Verify the OTP entered by the user against the one that was sent. Pass the uuid and sms_id returned from the Send OTP response.
| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| un | String | Required | iSMS account username | myuser |
| pass | String | Required | iSMS account password | mypass |
| mobile | Integer | Required | Same mobile number used when sending OTP (no country code, no leading 0) | 1XXXXXXXXX |
| country_code | Integer | Required | Country calling code | 60 |
| method | String | Required | Must be verify | verify |
| code | Integer | Required | The OTP code entered by the user | 515296 |
| sms_id | Integer | Required | The sms_id from the Send OTP response | 1171081605 |
| uuid | String | Required | The uuid from the Send OTP response | 1a1e1b86-4f2d-... |
| interval | Integer | Optional | OTP expiry in minutes — e.g. 3 means OTP expires after 3 minutes | 3 |
| sendid | String | Optional | Sender ID used when sending OTP | MyApp |
<?php
// Values from your form (user-submitted OTP)
$userOtp = $_POST['otp']; // OTP entered by user
$uuid = $_SESSION['otp_uuid']; // Stored from Send OTP response
$smsId = $_SESSION['otp_sms_id']; // Stored from Send OTP response
$params = http_build_query([
'un' => 'myuser',
'pass' => 'mypass',
'mobile' => '1XXXXXXXXX',
'country_code' => '60',
'method' => 'verify', // Must be 'verify'
'code' => $userOtp,
'sms_id' => $smsId,
'uuid' => $uuid,
'interval' => '3', // OTP expires after 3 minutes
'sendid' => 'MyApp',
]);
$ch = curl_init('https://www.isms.com.my/2FA/request.php?' . $params);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$result = curl_exec($ch);
curl_close($ch);
$data = json_decode($result, true);
if ($data['status'] === 'Verified') {
echo 'OTP verified! User authenticated.';
// Proceed with login / transaction
} else {
echo 'Invalid OTP: ' . ($data['message'] ?? 'Verification failed');
}{
"status": "Verified",
"uuid": "1a1e1b86-4f2d-11eb-...",
"sms_id": "1171081605",
"code": "808902",
"mobile": "+601X-XXXXXXX"
}{
"status": "Failed",
"message": "Incorrect OTP Code",
"uuid": "1a1e1b86-4f2d-11eb-...",
"sms_id": "1171081605",
"code": "515296",
"mobile": "+601X-XXXXXXX"
}Check your iSMS account credit balance and expiry date.
https://www.isms.com.my/2FA/request.php?un=myuser&pass=mypass&method=balance| Parameter | Type | Required | Description |
|---|---|---|---|
| un | String | Required | iSMS account username |
| pass | String | Required | iSMS account password |
| method | String | Required | Must be balance |
<?php
$params = http_build_query([
'un' => 'myuser',
'pass' => 'mypass',
'method' => 'balance',
]);
$ch = curl_init('https://www.isms.com.my/2FA/request.php?' . $params);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
$result = curl_exec($ch);
curl_close($ch);
$data = json_decode($result, true);
echo 'Balance: ' . $data['balance'] . ' credits (Expires: ' . $data['expiration'] . ')';{"method":"balance","balance":"81.0","expiration":"29 Apr 2025"}| Field | Description |
|---|---|
| method | Echoes back the request method — balance |
| balance | Current SMS credit balance |
| expiration | Account credit expiry date — credits are forfeited after this date |
Contact our team — we'll guide you through setup and integration.