Anchor SMS delivers one-time passwords through the same sendMtSms endpoint. Your application generates and verifies the code, and Anchor handles fast, reliable delivery to Malaysian mobile numbers.

Recommended flow

1. Generate a random 6-digit code on your server and store it with an expiry (for example 5 minutes).
2. Send it with POST /mt/sendMtSms, Base64-encoding the message text.
3. Check the 201 response and statusCode: 001 to confirm UMG accepted it.
4. Track the delivery notification (100 / DELIVRD) on your callback URL.
5. Verify the code the user enters against your stored value, then invalidate it.

Example

# message text: "Your OTP is 482916. Valid for 5 minutes."
curl -X POST "https://api.anchor-sms.com:8443/mt/sendMtSms" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clientMsgId": "OTP-10001",
    "dataCoding": 0,
    "destAddr": "60123456789",
    "msgEncoded": "'"$(printf 'Your OTP is 482916. Valid for 5 minutes.' | base64)"'",
    "senderId": "YOUR_SENDER_ID",
    "srcTon": "0", "srcNpi": "0", "destTon": "0", "destNpi": "0"
  }'

Best practices

• Use a unique clientMsgId per message so you can reconcile delivery reports.
• Rate-limit OTP requests per phone number and per IP to prevent abuse.
• Handle codes 101, 202 and 203 explicitly (unreachable number, low balance, no route).

See: status and error codes.