DEV Community: 2FASMS

Cómo obtener números de verificación por SMS con la API de 2FASMS

2FASMS — Thu, 05 Nov 2026 07:05:52 +0000

¿Necesitas un número de teléfono para recibir un código de verificación por SMS y quieres hacerlo desde código en lugar de navegar por una web? Este tutorial muestra cómo usar la API REST de 2FASMS para consultar tu saldo, listar los servicios disponibles, comprar un número virtual y leer el código SMS.

Todas las peticiones usan curl, así que puedes seguirlo desde cualquier terminal. Al final hay una colección de Postman lista para usar.

Requisitos previos

Una cuenta de 2FASMS
Tu clave de API, que aparece en los ajustes de tu cuenta

Guarda la clave en una variable de entorno para no pegarla en los comandos ni subirla por error a un repositorio:

export API_KEY="YOUR_API_KEY"

La URL base de todas las peticiones es https://api.2fasms.com. Los endpoints autenticados esperan tu clave en la cabecera Authorization como token Bearer.

Paso 1: Consultar tu saldo

curl -H "Authorization: Bearer $API_KEY" \
     "https://api.2fasms.com/order/api/get_balance"

Respuesta:

{
  "balance": 25.50,
  "user_id": 123
}

Si falta la clave obtienes un 400, y si la clave no es válida, un 401.

Paso 2: Listar los servicios disponibles

Este endpoint no requiere autenticación. Añade el slug de un país para ver los servicios de ese país:

curl "https://api.2fasms.com/order/api/services?country=france"

Respuesta (abreviada):

{
  "country": "france",
  "services": [
    {
      "name": "whatsapp",
      "providers": ["provider_5", "provider_7", "provider_9"],
      "min_price": 15.20,
      "max_price": 33.50
    }
  ],
  "total": 89,
  "from_cache": true
}

El campo name es el slug del servicio que usarás en el siguiente paso. Para ver la lista de países y sus slugs, llama a GET /order/api/countries.

Paso 3: Comprar un número

Envía un POST con los slugs del país y del servicio:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"country":"france","service":"whatsapp"}' \
     "https://api.2fasms.com/order/api/get_number"

Respuesta:

{
  "orderId": 12345,
  "number": "+33123456789",
  "status": "ok"
}

Guarda el orderId: lo necesitas para leer el SMS. Usa el number en la aplicación o web donde quieres recibir el código.

Posibles errores: 400 por parámetros inválidos, 406 por saldo insuficiente y 500 si el servicio o el país no están disponibles.

Paso 4: Leer el código SMS

Cuando hayas solicitado el código en el servicio de destino, consulta el pedido:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"orderId":12345}' \
     "https://api.2fasms.com/order/api/check_order"

Cuando llega el SMS, la respuesta contiene el código:

{
  "status": "success",
  "data": [{ "orderId": 12345, "sms": "123456" }]
}

Este pequeño bucle de shell consulta cada 5 segundos durante 2 minutos como máximo:

for i in $(seq 1 24); do
  curl -s -X POST \
       -H "Authorization: Bearer $API_KEY" \
       -H "Content-Type: application/json" \
       -d '{"orderId":12345}' \
       "https://api.2fasms.com/order/api/check_order"
  echo
  sleep 5
done

Obtienes un 404 si el pedido no existe y un 400 si falta orderId.

Webhook en lugar de consultar cada pocos segundos

Puedes registrar un endpoint HTTPS y 2FASMS enviará con POST cada SMS recibido:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"url":"https://your-app.com/sms-hook"}' \
     "https://api.2fasms.com/user/webhook"

El contenido incluye el ID del pedido, el servicio, el país, el texto completo del SMS, el code extraído, el número y la hora de recepción. Las entregas fallidas (respuestas que no son 2xx) se reintentan hasta 3 veces. Envía una url vacía para desactivar el webhook.

Paso 5: Finalizar el pedido

Cuando termines, cierra el pedido:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"orderId":12345}' \
     "https://api.2fasms.com/order/api/finish_order"

{
  "message": "order has been finished"
}

Un 406 significa que el pedido ya estaba cancelado o caducado, o que el SMS sigue pendiente.

Pruébalo en Postman

He reunido las cuatro peticiones principales (saldo, servicios, compra de número y lectura del SMS) en una colección pública de Postman. La clave es una variable {{api_key}}: solo tienes que poner la tuya.

https://documenter.getpostman.com/view/59423970/2sBYHXRJZs

Para terminar

Este es el flujo completo: saldo, servicios, número, código. A partir de aquí puedes integrarlo en tu suite de pruebas, en la automatización de registros de tu entorno de staging o en cualquier flujo que necesite un número temporal.

Puedes crear una cuenta y obtener tu clave de API aquí: https://2fasms.com/?ref=dev-tuto

Divulgación: trabajo en el equipo de 2FASMS.

How to get SMS verification numbers with the 2FASMS API

2FASMS — Tue, 03 Nov 2026 13:25:28 +0000

Need a phone number to receive an SMS verification code, and want to do it from code instead of clicking through a website? This tutorial shows how to use the 2FASMS REST API to check your balance, list available services, buy a virtual number and read the SMS code.

All requests below use curl, so you can follow along from any terminal. A ready-made Postman collection is linked at the end.

Prerequisites

A 2FASMS account
Your API key, shown in your account settings

Store the key in an environment variable so you never paste it into commands or commit it by accident:

export API_KEY="YOUR_API_KEY"

The base URL for every request is https://api.2fasms.com. Authenticated endpoints expect your key in the Authorization header as a Bearer token.

Step 1: Check your balance

curl -H "Authorization: Bearer $API_KEY" \
     "https://api.2fasms.com/order/api/get_balance"

Response:

{
  "balance": 25.50,
  "user_id": 123
}

If the key is missing you get a 400, and an invalid key returns a 401.

Step 2: List the available services

This endpoint does not need authentication. Pass an optional country slug to get the services for one country:

curl "https://api.2fasms.com/order/api/services?country=france"

Response (shortened):

{
  "country": "france",
  "services": [
    {
      "name": "whatsapp",
      "providers": ["provider_5", "provider_7", "provider_9"],
      "min_price": 15.20,
      "max_price": 33.50
    }
  ],
  "total": 89,
  "from_cache": true
}

The name field is the service slug you will use in the next step. If you want the list of countries and their slugs, call GET /order/api/countries.

Step 3: Buy a number

Send a POST with the country and service slugs:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"country":"france","service":"whatsapp"}' \
     "https://api.2fasms.com/order/api/get_number"

Response:

{
  "orderId": 12345,
  "number": "+33123456789",
  "status": "ok"
}

Keep the orderId: you need it to read the SMS. Use the number in the app or website where you want to receive the code.

Possible errors: 400 for invalid parameters, 406 for insufficient funds, and 500 if the service or country is unavailable.

Step 4: Read the SMS code

Once you have requested the code on the target service, poll the order:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"orderId":12345}' \
     "https://api.2fasms.com/order/api/check_order"

When the SMS has arrived, the response contains the code:

{
  "status": "success",
  "data": [{ "orderId": 12345, "sms": "123456" }]
}

Here is a small shell loop that polls every 5 seconds, for up to 2 minutes:

for i in $(seq 1 24); do
  curl -s -X POST \
       -H "Authorization: Bearer $API_KEY" \
       -H "Content-Type: application/json" \
       -d '{"orderId":12345}' \
       "https://api.2fasms.com/order/api/check_order"
  echo
  sleep 5
done

You get a 404 if the order does not exist and a 400 if orderId is missing.

Prefer a webhook to polling

Instead of polling, you can register an HTTPS endpoint and 2FASMS will POST each received SMS to it:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"url":"https://your-app.com/sms-hook"}' \
     "https://api.2fasms.com/user/webhook"

The payload contains the order ID, service, country, the full SMS text, the extracted code, the number and the reception time. Failed deliveries (non-2xx responses) are retried up to 3 times. Send an empty url to disable the webhook.

Step 5: Finish the order

When you are done, close the order:

curl -X POST \
     -H "Authorization: Bearer $API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"orderId":12345}' \
     "https://api.2fasms.com/order/api/finish_order"

{
  "message": "order has been finished"
}

A 406 means the order was already cancelled or expired, or that the SMS is still pending.

Try it in Postman

I put the four main requests (balance, services, buy a number, read the SMS) in a public Postman collection. The key is a {{api_key}} variable, so just set it to your own key:

https://documenter.getpostman.com/view/59423970/2sBYHXRJZs

Wrapping up

That is the whole flow: balance, services, number, code. From here you can plug it into your own test suite, a signup automation for your staging environment, or any workflow that needs a throwaway number.

You can create an account and get your API key here: 2FASMS

Disclosure: I work on the 2FASMS team.

Getting Started with API Integration: A Beginner-Friendly Guide

2FASMS — Tue, 03 Nov 2026 05:32:54 +0000

Introduction

APIs (Application Programming Interfaces) allow different software applications to communicate and exchange information. They are widely used in web development, mobile applications, automation, and software integration.

In this tutorial, we will explore the basic concepts of API integration and learn how to test API requests using Postman.

What Is an API?

An API is a set of rules that allows one application to interact with another application.

For example, a mobile application can use an API to retrieve information from a remote server and display it to users.

APIs help developers:

Connect different applications.

Retrieve and send data.

Automate repetitive operations.

Integrate external services into their projects.

Understanding HTTP Methods

Most REST APIs use HTTP methods to define the type of operation being performed.

Common methods include:

GET – Retrieve information from a server.

POST – Submit new information.

PUT – Replace existing information.

PATCH – Update specific information.

DELETE – Request the removal of information.

The method you choose depends on the API endpoint and its documentation.

Understanding API Endpoints

An endpoint is a specific URL through which an application accesses an API resource.

For example, a documentation website might provide an endpoint such as:

https://api.example.com/v1/resources

This is only an illustrative URL, not a working 2FASMS endpoint.

Before sending a request, always check the official API documentation for:

The endpoint URL.

The required HTTP method.

Authentication requirements.

Request parameters.

Expected response format.

Testing API Requests with Postman

Postman is a popular tool for testing and documenting APIs.

Here is a basic workflow:

Open Postman.

Create a new HTTP request.

Select the appropriate HTTP method.

Enter the API endpoint.

Add the required headers and parameters.

Send the request.

Review the server response.

Postman helps developers understand how an API behaves before integrating it into an application.

Understanding API Responses

An API commonly returns data in JSON format.

For example:

{
"success": true,
"message": "Request completed successfully",
"data": {
"status": "active"
}
}

This is an illustrative response. Actual response fields depend on the API.

Developers should also check HTTP status codes:

200 OK – The request was successful.

201 Created – A resource was created.

400 Bad Request – The request contains invalid information.

401 Unauthorized – Authentication is required or invalid.

403 Forbidden – Access is not permitted.

404 Not Found – The requested resource was not found.

500 Internal Server Error – The server encountered an error.

API Security Best Practices

Security is an essential part of API development.

Follow these practices:

Keep API keys and tokens private.

Use HTTPS when communicating with APIs.

Never publish passwords or secret credentials.

Validate incoming data.

Follow the authentication requirements of the API provider.

Read the official documentation before integrating a service.

Conclusion

Understanding APIs is an important skill for modern developers. With tools such as Postman, developers can test requests, inspect responses, and prepare integrations more efficiently.

Start with simple requests, read the documentation carefully, and build your API integration step by step.

Happy coding!