How to Integrate an SMS API into a Website
By Zoril SMS team · Published · Updated
Sending SMS from your own system — order confirmations, one-time codes, alerts — takes a single HTTP request. Doing it reliably takes a little more care.
Keep the API key on the server
Never put an API key in browser JavaScript or a mobile app bundle. Call the SMS API from your backend and store the key in an environment variable.
Send a message
Make a POST request to https://sms.zoril.app/api/public/v1/sms/send with your key in the Authorization header and a JSON body containing the recipient ("to") and the message ("body"). Store the returned message ID.
Handle errors and limits
A 401 means the bearer key is missing, invalid or revoked. A 403 may mean API access is not included in the assigned plan; 402 can indicate a subscription problem. A 429 covers rate or allowance limits; inspect the error and any retry/reset fields instead of assuming every limit resets at midnight. Retry only recoverable errors with bounded backoff.
Receive webhooks
Register a webhook URL to receive replies and delivery updates. Verify the signature on every webhook before trusting it, and respond quickly with a 2xx status.