PVAPins API docs for SMS verification

Why developers use PVAPins API

Predictable responses, clear flows, and practical guidance for production.

Quickstart (temporary flow)

Replace YOUR_API_KEY, COUNTRY_ID, APP_ID, and NUMBER with your values.

curl -s 'https://api.pvapins.com/user/api/load_countries.php'

curl -s 'https://api.pvapins.com/user/api/load_apps.php?country_id=COUNTRY_ID'

curl -s 'https://api.pvapins.com/user/api/get_number.php?customer=YOUR_API_KEY&app=APP_NAME&country=COUNTRY_NAME'

# Poll every 3–6s with backoff
curl -s 'https://api.pvapins.com/user/api/get_sms.php?customer=YOUR_API_KEY&number=NUMBER&country=COUNTRY_NAME&app=APP_NAME'

Combine / operator (optional): For services that use a group name plus an operator suffix on the site, add &operator=OPERATOR_SUFFIX and set app to the group name (not the full internal name). Use the same pairing on get_number, get_sms, and reject endpoints. If you omit operator, app must stay the full app name, unchanged from before.

# get_number / get_sms / reject — use the same app + operator pair everywhere
curl -s 'https://api.pvapins.com/user/api/get_number.php?customer=YOUR_API_KEY&app=GROUP_NAME&country=COUNTRY_NAME&operator=OPERATOR_SUFFIX'

Integration tip: Use exponential backoff (e.g. 3s → 5s → 8s) and stop after a timeout.

Authentication & API key

One key works on both APIs. Send it in a header — the ?customer= query form still works for existing integrations, but a key in a URL ends up in access logs, Referer headers and browser history, so don't build new code on it.

# preferred
curl -s -H 'X-API-Key: YOUR_API_KEY' 'https://api.pvapins.com/api/v1/account'

# also accepted
curl -s -H 'Authorization: Bearer YOUR_API_KEY' 'https://api.pvapins.com/api/v1/account'

REST API v1 — JSON endpoints

The modern API: JSON in, JSON out, header authentication, ISO country codes and a machine-readable OpenAPI 3.1 spec you can generate a client from. Base URL https://api.pvapins.com. Everything below is also browsable and runnable in the interactive reference.

Endpoints

Quickstart — country to OTP in four calls

curl -s -H 'X-API-Key: YOUR_API_KEY' 'https://api.pvapins.com/api/v1/services'

# {"services":[{"code":"wa","name":"Whatsapp"},{"code":"course-hero","name":"Course Hero"}, ...]}

curl -s -H 'X-API-Key: YOUR_API_KEY' \
  'https://api.pvapins.com/api/v1/operators?country=US&service=wa'

# {"operators":[{"operator":2,"label":"Operator 2","price":0.15,"count":42}, ...]}
# count: null means "stock unknown", NOT zero — those operators are still buyable.

curl -s -X POST 'https://api.pvapins.com/api/v1/orders' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: YOUR_UNIQUE_ID' \
  -d '{"country":"US","service":"wa","operator":2}'

# {"id":"1048576","phoneNumber":"+15551234567","status":"active","price":0.15,"expires_in":1200}
# Omit "operator" to auto-pick the most reliable operator in stock and bill its price.

# Poll every 3-5s until otpCode is filled or status leaves "active".
# There are no customer webhooks — polling is the delivery path.
curl -s -H 'X-API-Key: YOUR_API_KEY' 'https://api.pvapins.com/api/v1/orders/1048576'

# {"id":"1048576","status":"completed","otpCode":"418494","phoneNumber":"+15551234567"}

Service codes are not all two or three letters. Where we have an sms-activate slug we keep it (wa, tg, go = Gmail, ts = PayPal) — those you cannot guess. Everything else gets a slug derived from the name (course-hero, capital-one-shopping), and a service whose name has no Latin characters gets svc-<id>. Read the code from GET /api/v1/services, or pass the service name instead — POST /orders, GET /operators and GET /numbers all accept a name wherever they accept a code.

Order errors

Rate limits: per API key, per endpoint, per minute — 60/min on most endpoints, higher on OTP polling, and lower on the calls that consume stock. Over the limit you get 429 with a Retry-After header; the limits are tuned at runtime, so read the header rather than hardcoding a number.

Temporary numbers — core endpoints

One-time verification sessions. See full reference for payloads and errors.

Rent numbers API

For repeated OTPs or longer access — keep rent calls separate in your codebase.

curl -s 'https://api.pvapins.com/user/api/get_number.php?customer=YOUR_API_KEY&app=APP_NAME&country=COUNTRY_NAME&is_rent=1'

Combine / operator: Optional &operator=… works with rent requests too — same rules as the temporary flow (app = group name when operator is set).

Errors, rate limits & stability

Treat limits as normal — throttle, backoff, and map errors to clear actions.

Temporary vs rent

Pick the right model before you wire up automation.

FAQs

Quick answers for integrators.