API reference · SMS

Transactional SMS

Send order, delivery and account alerts over SMS in India using your DLT-registered templates. For login codes use OTP verification instead — it handles codes, expiry and fallback for you.

Let your coding assistant do this

Claude Code, Cursor, Copilot and Windsurf can wire this up for you. Copy the prompt into your assistant: it points it at our API guide (every endpoint with its real fields and error codes) and spells out the rules integrations most often get wrong.

prompt · SMS alerts

Read https://quickauth.in/llms-full.txt first — it is QuickAuth's API guide with the real endpoint paths, field names, response shapes and error codes. Then add transactional SMS alerts to this project, following the conventions already in the codebase.

Rules:
- Keep X-Client-Id and X-Client-Secret in server-side environment variables, never in client code.
- Send with POST /v1/sms/send using the numeric DLT templateId, variableValues by name, and an idempotencyKey derived from the business event.
- Phone numbers are digits with country code, e.g. 919876543210.
- Retry 5xx with backoff using the same idempotencyKey; do not retry 4xx.
- Branch on errorCode, not message (error codes: https://quickauth.in/docs/errors).

Add tests for the error paths, and tell me which environment variables to set.

Open in Claude Open in ChatGPT Read the guide

Before your first send

Register your entity, sender id (header) and templates on your operator’s DLT portal.
Add the sender id and templates in the QuickAuth dashboard under DLT.
For each template, name its variables (for example name, orderId) so you can send them by name.

Template text must match DLT exactly

Operators reject an SMS whose text differs from the approved template. QuickAuth fills the {#var#} slots with your values; everything else comes from the template you registered.

Send an SMS

POST/v1/sms/send

Sends one transactional SMS using a DLT-approved template — order updates, delivery alerts, reminders. The SMS is handed to the operator before the call returns, so a 200 means the operator accepted it.

AuthServer keyX-Client-Id + X-Client-Secret

Request body

templateIdstringrequired
The DLT template id (the long number from your DLT portal, e.g. 1107168123456789012) of one of your active templates. Not the template name.
tostringrequired
Recipient number. Digits are kept, everything else removed, so +91 98765-43210 works. A 10-digit number is sent to India.
variableValuesobjectoptional
Values by the variable names you gave the template in the dashboard, e.g. {"name": "Asha", "orderId": "A-1029"}. Names are not case-sensitive. Recommended — order does not matter and a missing value is reported by name.
variablesstring[]optional
Values in the order the {#var#} slots appear in the template. Used only when variableValues is empty. Extra values are ignored.
senderIdstringoptional
Your 6-letter DLT header, e.g. ACMEIN. Defaults to the sender you added most recently.
idempotencyKeystringoptional
Up to 128 characters. If you send the same key again within 15 minutes, you get the first result back and no second SMS is sent. Use your own order or event id. Best-effort: treat it as protection against quick retries, not a permanent guarantee.

Response · 200

messageIdstring | null
The operator’s message id. Keep it if you want to match delivery reports later.
statusstring
Always SENT (accepted by the operator). Failures come back as errors, never as a different status.
tostring
The recipient as you sent it, digits only.

Errors

400INVALID_REQUESTtemplateId or to missing, or to has fewer than 10 digits.
400INVALID_REQUESTtemplateId is not one of your active DLT templates.
400INVALID_REQUESTsenderId is not registered on your account, or you have no sender id at all.
400INVALID_REQUESTVariables do not fit the template: too few values, an unknown or missing name, letters in a {#numeric#} slot, or a {#url#} slot that does not start with http(s)://.
401INVALID_CLIENT_CREDENTIALSX-Client-Id or X-Client-Secret is missing, unknown or wrong.
401CLIENT_INACTIVEYour account has been deactivated.
402INSUFFICIENT_BALANCEWallet is empty.
402INSUFFICIENT_SMS_BALANCENo SMS credits left.
500PROVIDER_ERRORThe SMS operator refused the message. Safe to retry with the same idempotencyKey.
500INTERNAL_ERRORUnexpected server error, including a body that is not valid JSON. Retry; if it persists, send us the requestId.

Request

curl -X POST "https://api.quickauth.in/v1/sms/send" \
  -H "X-Client-Id: YOUR_CLIENT_ID" \
  -H "X-Client-Secret: YOUR_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
  "templateId": "1107168123456789012",
  "to": "919876543210",
  "variableValues": {
    "name": "Asha",
    "orderId": "A-1029"
  },
  "idempotencyKey": "order-A-1029-shipped"
}'

Response200

{
  "messageId": "8b1e5d2c-7f40-4c11-9a3e-0d6f2b9a1c77",
  "status": "SENT",
  "to": "919876543210"
}

Send an SMS (URL form)

GET/v1/sms/send

The same send as above, with everything in the URL. Made for systems that can only fire a URL — older ERPs, billing software, IVR and no-code tools. If you can send JSON, use Send an SMS instead.

On this endpoint only, credentials may also be passed as clientId and clientSecret query parameters. URLs end up in logs, so prefer the headers whenever your tool allows it.

AuthServer keyX-Client-Id + X-Client-Secret

Query parameters

templateIdstringrequired
DLT template id.
tostringrequired
Recipient number.
var1, var2, …stringoptional
Template values in order. Numbering must not skip: with var1 and var3 only var1 is read. Named values are not available in this form.
senderIdstringoptional
Your DLT header. Defaults to your most recent one.
idempotencyKeystringoptional
Same as the JSON form.
clientIdstringoptional
Instead of the X-Client-Id header.
clientSecretstringoptional
Instead of the X-Client-Secret header.

Response · 200

messageIdstring | null
The operator’s message id. Keep it if you want to match delivery reports later.
statusstring
Always SENT (accepted by the operator). Failures come back as errors, never as a different status.
tostring
The recipient as you sent it, digits only.

Errors

400INVALID_REQUESTtemplateId or to missing, or to has fewer than 10 digits.
400INVALID_REQUESTtemplateId is not one of your active DLT templates.
400INVALID_REQUESTsenderId is not registered on your account, or you have no sender id at all.
400INVALID_REQUESTVariables do not fit the template: too few values, an unknown or missing name, letters in a {#numeric#} slot, or a {#url#} slot that does not start with http(s)://.
401INVALID_CLIENT_CREDENTIALSX-Client-Id or X-Client-Secret is missing, unknown or wrong.
401CLIENT_INACTIVEYour account has been deactivated.
402INSUFFICIENT_BALANCEWallet is empty.
402INSUFFICIENT_SMS_BALANCENo SMS credits left.
500PROVIDER_ERRORThe SMS operator refused the message. Safe to retry with the same idempotencyKey.
500INTERNAL_ERRORUnexpected server error, including a body that is not valid JSON. Retry; if it persists, send us the requestId.

Request

curl -X GET "https://api.quickauth.in/v1/sms/send?templateId=1107168123456789012&to=919876543210&var1=Asha&var2=A-1029" \
  -H "X-Client-Id: YOUR_CLIENT_ID" \
  -H "X-Client-Secret: YOUR_CLIENT_SECRET"

Response200

{
  "messageId": "8b1e5d2c-7f40-4c11-9a3e-0d6f2b9a1c77",
  "status": "SENT",
  "to": "919876543210"
}