Documentation

MessageLab turns an Android phone and its SIM into an SMS gateway. The web dashboard supports device pairing, single and bulk SMS, one-time scheduled campaigns, inbound SMS, delivery status, plans, and payments.

Recipients may be standard supported mobile numbers or approved Bangladesh service numbers such as 16222. Service-code delivery still depends on the connected SIM and carrier.

Quick Start

1. Create and verify a MessageLab account.
2. Install the Android app from the official download page.
3. Open Devices in the dashboard and pair the phone by QR code or pairing code.
4. Keep the Android app connected so SMS can use the paired phone and SIM.

Developer API

API base URL: https://api.messagelab.tech/api/v1. Developer API access and OTP access are controlled by the active plan.

Authentication and API keys

Create a key from Dashboard → Developer API. Send it in the x-api-key header. Keys are shown in full only once; never put one in browser code, a public repository, or analytics.

curl https://api.messagelab.tech/api/v1/otp/verifications \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_SERVER_SIDE_API_KEY"

Create OTP

POST /otp/verifications requires the otp:create permission and a live paired gateway device.

{"recipient":"+8801XXXXXXXXX","reference":"checkout-123","metadata":{"purpose":"login"}}

Returns requestId, expiresAt, and status. The verification code is sent through the paired Android phone and expires after five minutes.

Verify OTP

POST /otp/verifications/verify with otp:verify permission:

{"requestId":"otp_REQUEST_ID","code":"123456"}

Codes are six digits. Verification requests expire after five minutes and allow at most five attempts.

Resend and status

• POST /otp/verifications/:requestId/resend resends within the configured quota and at most three resends.
• GET /otp/verifications/:requestId returns verification status, delivery status, expiry, attempts, and resend count.

Examples

PowerShell

$headers = @{ "x-api-key" = $env:MESSAGELAB_API_KEY }
$body = @{ recipient = "+8801XXXXXXXXX"; reference = "login" } | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "https://api.messagelab.tech/api/v1/otp/verifications" -Headers $headers -ContentType "application/json" -Body $body

Node.js

const response = await fetch("https://api.messagelab.tech/api/v1/otp/verifications", {
  method: "POST",
  headers: { "Content-Type": "application/json", "x-api-key": process.env.MESSAGELAB_API_KEY },
  body: JSON.stringify({ recipient: "+8801XXXXXXXXX", reference: "login" })
});
const result = await response.json();

Python

import os, requests
response = requests.post(
    "https://api.messagelab.tech/api/v1/otp/verifications",
    headers={"x-api-key": os.environ["MESSAGELAB_API_KEY"]},
    json={"recipient": "+8801XXXXXXXXX", "reference": "login"},
)
print(response.json())

Postman and CMD: create a POST request to the create endpoint, add x-api-key and Content-Type: application/json headers, then use the JSON body above. In Windows CMD, keep the key in an environment variable and do not paste it into a saved collection.

Errors, limits, and security

Responses use success, data, and a human-readable message. Common statuses are 400 (validation), 401 (missing or invalid key), 403 (plan or permission), 404 (unknown request), and 429 (quota or rate limit). Daily quotas come from the active plan; a phone is limited to five OTP requests per day, with five verification attempts and three resends per request.

MessageLab never asks you to publish an API key or OTP. Keep keys server-side, use HTTPS, avoid logging recipient numbers and codes, and do not send secrets, tokens, phone numbers, or message content to analytics.

Troubleshooting and FAQ

• No SMS sent: confirm a paired device is active and has network access, SIM balance, and SMS permission.
• 403 response: ask an account owner to enable API and OTP access on the plan.
• 401 response: check the server-side x-api-key value and whether the key was revoked.
• OTP expired: create a new request; codes are valid for five minutes.
• Is there a webhook? No webhook endpoint is currently enabled. Use the status endpoint.

For account or device help, visit Help Center or Contact Support.