Resell SMS verification with the Noir SMS API: your platform, your prices, our numbers

How the money works

There is exactly one balance: yours. You add funds to your Noir SMS account by card or by USDC or SOL, exactly like any other customer, and every number your platform buys through the API is debited from that balance. Your customers never pay Noir SMS. They pay you, through whatever checkout, wallet or credit system your platform uses, and you decide what they pay.

Refunds follow the same logic. If a number receives no SMS within 20 minutes it expires and the price goes back to your Noir SMS balance; if you cancel it after 2 minutes, it is refunded too. How you credit your customer is up to you, but the fair approach is to mirror it: no code, no charge. A purchase on an empty balance fails with 402 insufficient_balance, so watch GET /balance and top up in time.

Setting prices and protecting your margin

Noir SMS prices follow supply and demand and can change during the day. Your margin is the difference between what you charge and what the number costs at the moment of purchase.

• Read live costs from GET /services?country=xx and refresh your catalog regularly instead of hardcoding prices.
• Send max_price on every POST /numbers. If the cost moved above what your retail price can absorb, you get 409 price_above_max and are not charged.
• Hide services and countries with no stock, and handle 400 no_numbers gracefully: the customer was not charged and can pick another country.

# Your cost per number and stock for Canada, right now
curl "https://noirsms.com/api/v1/services?country=ca" \
  -H "Authorization: Bearer nsk_live_YOUR_KEY"

# Your balance, so your panel can stop selling before it runs out
curl https://noirsms.com/api/v1/balance -H "Authorization: Bearer nsk_live_YOUR_KEY"

Medium and high volume

If your platform buys numbers every day, talk to us. Log in, open the Support area of your dashboard and open a ticket telling us roughly how many numbers you buy per month, which services and countries, and what your platform is. We review each request and can offer special conditions to resellers with medium or high volume.

Conditions depend on real usage and on keeping a clean record under the Acceptable Use Policy, so a short history of API purchases on your account helps.

Ask for volume conditions

Keeping your customers updated with webhooks

Set an HTTPS webhook URL on the API page of your dashboard. When an SMS reaches a number you bought through the API, Noir SMS POSTs an sms.received event with the number_id, phone, service, country and the SMS code and text. Store the number id with your customer's order, then match each event and push the code to their screen, chat or email.

Always verify the X-NoirSMS-Signature header (HMAC-SHA256 over the timestamp and raw body, with your webhook secret) and reject old timestamps, otherwise anyone who finds your URL could fake codes. Webhooks also matter for scale: one key allows 120 requests per minute, and webhooks cost nothing against that limit.

import express from 'express';
import crypto from 'node:crypto';

const app = express();
const SECRET = process.env.NOIRSMS_WEBHOOK_SECRET; // shown on the API page of your dashboard

app.post('/hooks/noirsms', express.raw({ type: 'application/json' }), (req, res) => {
  const { t, v1 } = Object.fromEntries(req.get('X-NoirSMS-Signature').split(',').map((p) => p.split('=')));
  const expected = crypto.createHmac('sha256', SECRET).update(t + '.' + req.body).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) <= 300;
  if (!fresh || expected.length !== v1.length || !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) {
    return res.sendStatus(401);
  }
  const event = JSON.parse(req.body);
  if (event.type === 'sms.received') {
    // Find YOUR customer's order by event.data.number_id and show them event.data.sms.code
    notifyCustomer(event.data.number_id, event.data.sms.code);
  }
  res.sendStatus(200);
});

Your responsibilities as a reseller

Reselling puts you between Noir SMS and people we never see, so the rules travel with the numbers. Your customers must follow the same Acceptable Use Policy as direct customers: numbers are for verifying their own legitimate accounts, following each platform's terms. Fraud, scams, impersonation, harassment, bulk or automated account creation, ban evasion, spam and bypassing bank, fintech, crypto-exchange or identity (KYC) checks are prohibited.

You are responsible for abuse that happens through your platform. In practice that means publishing these rules in your own terms, not marketing your service for prohibited uses, not offering banking, fintech or crypto-exchange verification, limiting obviously automated or bulk buying, and suspending customers who break the rules. Accounts that resell to abusers are closed, and a closed account cannot buy numbers for any of its customers.

What to tell your customers

Numbers receive SMS only, with no calls or outgoing texts. Each number is for one verification on one service and is recycled later by the provider, so it is not a long-term recovery number; anyone keeping an account should add their own phone, email or authenticator app afterwards. Numbers are carrier mobile numbers rather than VoIP, so they usually work where VoIP numbers are rejected, but no app accepts every number, which is exactly why automatic refunds exist.

Step by step

1. Fund one balanceCreate a Noir SMS account, add funds and generate your API key on the API page of the dashboard.
2. Build your catalogRead services, countries and live costs from the API, set your own retail prices and send max_price on every purchase.
3. Deliver and enforcePush codes to customers through the sms.received webhook and enforce the Acceptable Use Policy on your platform.