One authenticated POST sends an SMS or MMS to a US number. No SDK required, no client library to keep up to date — if your language can make an HTTPS request, you can send a message. Base URL https://api.signalmash.com.
Every request carries a token in the Authorization header. You create tokens in the portal under API → Tokens, and you can issue a separate token per integration and scope each one to the functions it needs — so a webhook consumer never holds send permissions, and rotating one integration's token does not take the others down.
Authorization: YOUR_API_TOKEN
A single POST /messages with three fields. The body is multipart/form-data. A 201 response means the message was accepted for delivery.
curl -X POST https://api.signalmash.com/messages \ -H "Authorization: YOUR_API_TOKEN" \ -F "FROM=15035550100" \ -F "TO=15035550199" \ -F "BODY=Your Bright Dental appointment is confirmed for Tue 10am. Reply STOP to opt out."
import requests
resp = requests.post(
"https://api.signalmash.com/messages",
headers={"Authorization": "YOUR_API_TOKEN"},
files={
"FROM": (None, "15035550100"),
"TO": (None, "15035550199"),
"BODY": (None, "Your appointment is confirmed. Reply STOP to opt out."),
},
timeout=10,
)
resp.raise_for_status()
print(resp.status_code) # 201const form = new FormData();
form.append("FROM", "15035550100");
form.append("TO", "15035550199");
form.append("BODY", "Your appointment is confirmed. Reply STOP to opt out.");
const res = await fetch("https://api.signalmash.com/messages", {
method: "POST",
headers: { Authorization: process.env.SIGNALMASH_TOKEN },
body: form,
});
if (!res.ok) throw new Error(`Send failed: ${res.status}`);$ch = curl_init("https://api.signalmash.com/messages");
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ["Authorization: " . getenv("SIGNALMASH_TOKEN")],
CURLOPT_POSTFIELDS => [
"FROM" => "15035550100",
"TO" => "15035550199",
"BODY" => "Your appointment is confirmed. Reply STOP to opt out.",
],
]);
$response = curl_exec($ch);Same endpoint. Add an ATTACHMENT file part for an image, video or document, and the message is sent as MMS.
curl -X POST https://api.signalmash.com/messages \ -H "Authorization: YOUR_API_TOKEN" \ -F "FROM=15035550100" \ -F "TO=15035550199" \ -F "BODY=Here is your receipt." \ -F "ATTACHMENT=@receipt.pdf"
Rich messages go to POST /rcs/messages using the sender name from an approved RCS campaign, so you can add verified branding, rich cards and reply buttons without a second vendor or a second contract. See what RCS business messaging is for when it earns its higher per-message cost.
Subscribe a webhook with PUT /webhookSubscription and Signalmash posts inbound messages and delivery events to your endpoint. Two things worth building on day one: treat a 201 as accepted rather than delivered and rely on the delivery event for truth, and process STOP replies as an immediate, account-wide suppression rather than a per-campaign one.
Login codes and transaction confirmations do not go through /messages. Signalmash Verifier generates, delivers and expires the passcode for you through three form-encoded calls: /sendotpbysms, /sendotpbycall and /verifyotp. Examples and the full loop are on the OTP SMS API page.
The same API searches and provisions numbers, so onboarding a new customer does not need a support ticket: search by state, rate centre, NPA or NXX, buy a local or toll-free number, enable messaging on it, and import numbers you already own. Endpoints include /searchbystate, /searchbynpa, /buy, /BuyTollfree, /enablesms and /importNumber. GET /checkBalance returns account balance if you want to alert before you run dry.
Sending a message is the easy half. Getting it delivered in the US means A2P 10DLC registration: a brand record that matches your IRS filing, a campaign per messaging programme, sample messages, evidenced opt-in, and a vetting tier that determines your throughput. Most providers hand you a portal and wish you luck.
We do that registration for you and handle resubmissions if a campaign is rejected. It is part of onboarding, not a paid add-on. If you want to understand the process regardless of who you buy from, our A2P 10DLC requirements guide covers what you need before you start, and trust scores and throughput explains what sets your messages-per-second ceiling.
Per segment, with volume tiers, plus carrier pass-through fees that every US provider charges identically. Current rates are on the pricing page, and we published an honest comparison of US SMS API list rates — including where we are more expensive than the alternatives and why someone might still choose us.
Tell us what you are building and we will set up the account, register the 10DLC brand and campaign, and get you a working token — usually the same week.