OTPHub API v1
Programmatic access to balances, catalog, and OTP orders. Create credentials on the API keys page.
Authentication
Send these headers on every request, always over HTTPS:
X-Api-Key: ok_xxxxxxxxxxxxxxxx X-Api-Timestamp: 2026-06-20T15:45:00Z X-Api-Signature: hex_hmac_sha256(secret, METHOD + '\n' + REQUEST_URI + '\n' + timestamp + '\n' + raw_body)
The secret is shown only once, encrypted at rest, and used to sign requests without sending the secret itself. Timestamps older than 5 minutes are rejected.
Scopes
balance, countries, services, order, status, cancel
Endpoints
| Method | Path | Scope | Description |
|---|---|---|---|
| GET | /api/v1/balance.php | balance | Wallet balance |
| GET | /api/v1/countries.php | countries | Active countries |
| GET | /api/v1/services.php?country_id=ID | services | Services + price |
| POST | /api/v1/order.php | order | Buy a number |
| GET | /api/v1/status.php?order_id=ID | status | Poll for OTP |
| POST | /api/v1/cancel.php | cancel | Cancel pending order |
Place an order
curl -X POST https://numberpanel.404hub.online/api/v1/order.php \
-H "X-Api-Key: $KEY" -H "X-Api-Timestamp: $TS" -H "X-Api-Signature: $SIG" \
-H "Content-Type: application/json" \
-d '{"country_id":1,"service_id":7,"idempotency_key":"order-abc-123"}'
Pass a unique idempotency_key so retries never create duplicate orders or double charges.
{
"ok": true,
"idempotent": false,
"order": { "id": 42, "status": "pending", "number": "+1...", "price": "0.350000", "expires_at": "..." }
}
Poll for the OTP
curl https://numberpanel.404hub.online/api/v1/status.php?order_id=42 \ -H "X-Api-Key: $KEY" -H "X-Api-Timestamp: $TS" -H "X-Api-Signature: $SIG"
{ "ok": true, "status": "completed", "otp": "123456" }
Billing model
You are charged only when an OTP is delivered (status completed). Pending orders that expire or are cancelled are never charged.
Errors
Errors return { "ok": false, "error": "code", "message": "..." } with an HTTP status (401 unauthorized, 403 forbidden, 422 validation, 429 rate_limited).