Changelog

• FixedPrice alerts were evaluated against the pool price instead of the retail price, so a threshold set just under the listed price never fired.
• FixedThe Singapore entry point returned X-VSN-Region: eu-central on catalogue responses served from cache.

• FixedRentals renewed inside the last hour of their term were charged the new term twice. 41 accounts were credited back automatically the same day.
• FixedGET /v1/activations dropped the status filter once the cursor was followed past page 20, so later pages mixed completed and cancelled orders.
• ChangedThe compatibility endpoint rejects action=getNumber with an unknown service code in about 12 ms instead of waiting on a pool lookup that could never succeed.

Bulk activations

Buy up to 50 numbers for the same service and country in one call, with a result per item instead of an all-or-nothing failure.

• AddedPOST /v1/activations/bulk accepts up to 50 items and returns one result object per requested number, each with its own status and error code.
• AddedBulk purchase in the dashboard, with a live progress panel and per-row cancel while the batch is still filling.
• ChangedIdempotency keys apply to the whole bulk request: a replay returns the original result set rather than buying a second batch.
• ChangedBulk requests draw from at most three operators per batch, so a single bad range cannot take out an entire order.
• FixedThe pool scorer counted a failed batch once per request rather than once per number, which under-penalised operators that failed in bulk.

• RemovedPOST /v1/activations no longer accepts a pinned operator field, as announced on 2025-09-23. Requests that still send it are accepted and the field is ignored.
• FixedTwo-factor enrolment rejected authenticator apps that pad the shared secret to 32 characters with base32 padding.
• FixedCountry pages listed services whose only operator in that country had been retired six weeks earlier, so the row always showed zero stock.

Per-country retention

• AddedMessage retention is configurable per country between 1 and 30 days on contract accounts, for teams with data-residency commitments of their own.
• AddedretentionDays on the activation object, so a script can see what applies to a number before it buys it.
• ChangedThe nightly retention job writes an audit record per deleted batch — count, country and cut-off — available to business accounts on request.
• FixedDeleting an activation's messages from the dashboard left the extracted code in the CSV export until the next nightly run.

• FixedGET /v1/prices with more than 20 service and country pairs hit the gateway timeout instead of returning 400 with a clear limit error.
• FixedThe Frankfurt entry point served stock counts up to 90 seconds stale after a pool refresh, while Singapore served them immediately.

• FixedWebhook endpoints disabled after 72 hours of consecutive failures were silently re-enabled by any edit to their event list, including removing an event.
• Fixedwebhook.test deliveries counted towards the failure streak that disables an endpoint, so testing a broken endpoint could disable it.

Webhook tooling

• AddedSend a synthetic event of any type to a registered endpoint from the dashboard, signed exactly like a real delivery.
• Addedwebhook.test event type, excluded from delivery statistics and from the retry schedule.
• AddedThe delivery log keeps the request body, the response status and the first 2 KB of the response body for seven days, with a manual replay per delivery.
• ChangedAn endpoint that fails continuously for 72 hours is disabled, after warning emails at 6 and 24 hours.

• FixedPrice alerts were evaluated hourly rather than on every pool refresh, so dips that lasted under an hour went unreported.
• FixedThe uptime strip on the status page rendered left to right under Arabic while the rest of the page mirrored, putting today on the wrong end.

Price alerts

• AddedPrice alerts for a service and country pair, delivered by email or webhook when the retail price crosses a threshold you set.
• AddedGET /v1/prices accepts up to 50 service and country pairs in one request instead of one pair per call.
• Added23 countries, mostly Central American and Pacific territories. Coverage crosses 190 countries and territories.
• DeprecatedPinning operator on POST /v1/activations. Routing already picks the healthiest operator with stock; the field is ignored from 2026-03-31.

Twelve-month rentals

• AddedRental terms of 6 and 12 months, at a price fixed for the whole term rather than repriced at each renewal.
• Addedrental.expiring webhook event, fired 24 hours before a rental ends.
• ChangedAuto-renew checks that the upstream lease can actually be extended before it debits the balance, instead of debiting first and refunding on failure.
• FixedRentals crossing a daylight-saving boundary expired 60 minutes early in Europe/London and Europe/Lisbon.

• FixedIdempotency keys were stored per region, so a retry that landed in Singapore after a Frankfurt timeout bought a second number. Duplicate purchases in the affected window were refunded.
• FixedX-VSN-Region was missing from 402 and 429 responses.

Multi-region API

A second API entry point in Singapore cuts median round-trip latency from South-East Asia from 310 ms to 74 ms.

• AddedRegional entry points in Frankfurt and Singapore, selected by anycast. Both read the same catalogue and the same balance.
• AddedX-VSN-Region on every response, naming the entry point that served it.
• ChangedA long-poll connection is pinned to the region that accepted it for the life of the wait, so a code is never delivered to a region the client has left.
• ChangedPurchases are still serialised through the primary in Frankfurt; only reads and long-polls are served locally. Balance can never go negative because of a regional split.

• FixedLogin alerts fired after every browser update, because the full user agent string was part of the device fingerprint.
• FixedSessions expired 30 days after creation rather than after 30 days of inactivity, which is what the documentation and the setting both said.

Account security

• AddedTwo-factor confirmation is required to create an API key or widen its scopes, on accounts that have 2FA enabled.
• AddedEmail alert on sign-in from a new device or a new country, with the IP and the approximate location.
• ChangedSessions expire after 30 days of inactivity instead of 30 days from creation.
• ChangedRecovery codes are invalidated as a set when two-factor authentication is re-enrolled, so an old printout stops working.

• Added19 countries across East and West Africa — Ethiopia, Tanzania, Uganda, Zambia, Senegal, Ivory Coast and others.
• AddedSupport tickets opened from the dashboard carry the last 20 activations as context, so the first reply is not a request for identifiers.
• ChangedThe operator field on a completed activation names the range holder rather than the reseller we bought through, which is what you need to correlate failures.
• FixedService pages returned an empty table rather than an empty state when a country had no stock at all, which read like a loading failure.

• FixedThe MCP server advertised rentals:write tools to keys that did not hold the scope; calls failed with 403 rather than being hidden.
• FixedrequestId was missing from responses produced by the rate limiter, which are exactly the ones support gets asked about.
• FixedThe OpenAPI document declared wait as an integer while the API also accepted a numeric string.

Agent-ready API

A hosted MCP server, an OpenAPI 3.1 document and an llms.txt index, so an agent can discover and drive the whole activation lifecycle with a scoped key.

• AddedA hosted MCP server exposing buy, poll, cancel, complete and balance as tools, bound to the scopes of the key that connects.
• Addedllms.txt at the site root, indexing the public surface — pricing, endpoints, limits and policies — for agents and crawlers.
• Changed/openapi.json is now OpenAPI 3.1, generated from the same schema the API validates requests against, so the document cannot drift.
• ChangedEvery response carries requestId. Quoting it in a ticket is enough for support to find the exact request.
• ChangedBearer tokens are the documented default. X-Api-Key keeps working, is not deprecated, and will not be removed.

• FixedTwo services shared a slug after a rename, so one of the two service pages returned 404 for eleven days before anyone told us.
• FixedHreflang alternates on service pages pointed at the English URL for every language.

• Added46 services, mostly regional marketplaces and wallets in South-East Asia and Latin America, including Shopee, Lazada, Mercado Libre and PicPay.
• RemovedGET /v1/history, deprecated on 2024-06-11. Use GET /v1/activations, which is a superset.
• ChangedThe compatibility endpoint returns NO_NUMBERS instead of NO_BALANCE when the pool is empty but the balance is sufficient, which is what the original protocol means.

• AddedLocalised metadata, canonical URLs and hreflang alternates for all fifteen interface languages.
• AddedA sitemap covering every service and country landing page in every language.
• ChangedPublic pages are statically rendered and revalidated every five minutes. Time to first row on the pricing table fell from 1.9 s to 0.4 s.
• FixedThe 15-minute post-release hold was applied per provider rather than per number, which shrank the effective pool in countries with fewer than 200 numbers.

• AddedA fifth upstream provider, adding US and Canadian coverage for 60 services that previously had none in North America.
• AddedX-RateLimit-Reset as a Unix timestamp, alongside the existing limit and remaining headers.
• ChangedA released number is held out of the pool for 15 minutes, so a re-issue after a rejected verification does not land on the same range.

• FixedActivation windows shorter than 10 minutes were still refunded on the 20-minute schedule, delaying the credit by up to ten minutes.
• FixedAnomaly alerts compared the current success rate against an all-time average instead of the trailing seven days, so seasonal services alerted constantly.

• AddedAnomaly alerts: an email when a service and country pair you have used in the last 30 days drops more than 20 points in success rate.
• AddedThe activation window is configurable per purchase between 5 and 30 minutes. The default stays 20.
• ChangedCursor pagination on GET /v1/activations breaks ties on the identifier rather than the timestamp alone, so two activations created in the same millisecond are both returned.

• AddedGET /v1/activations with cursor pagination, status filters and a date range.
• AddedCSV export of activation history from the dashboard, with no row cap.
• AddedThe export includes the operator and the full SMS body where retention still allows it, so an audit does not need a second API call.
• DeprecatedGET /v1/history, superseded by GET /v1/activations. It stops answering on 2024-11-15.

• FixedConsolidated monthly invoices double-counted refunds issued in the last hour of the month.
• FixedPurchase-order references longer than 40 characters were truncated on the PDF without any indication.

Business accounts

• AddedContract rates, dedicated operator pools, a data processing agreement and net-15 terms for accounts above roughly 5,000 SMS a month.
• AddedMonthly consolidated invoices carrying purchase-order references.
• AddedA named escalation contact and a private channel for P1 issues.
• ChangedThe published SLA for contract accounts is 99.9 % monthly API availability with a 15-minute response on P1, measured excluding announced maintenance.

• AddedTON, BNB and SOL as top-up currencies through OxaPay.
• AddedUnder-payment handling: a partial deposit is credited for the amount actually received as soon as it is attributed, instead of being held for manual review.
• ChangedInvoice quotes are locked for 30 minutes instead of 15, after measuring how long Bitcoin confirmations really take at median fee rates.
• FixedA deposit sent to an expired invoice address needed a support ticket to be credited. Attributable deposits are now credited automatically within an hour.

• FixedPayout requests between €50.00 and €50.99 were rejected by an off-by-one comparison in cents.
• FixedThe referral dashboard showed lifetime earnings in the tier progress bar instead of the trailing-12-month figure the tier is based on.

Referral tiers

• AddedVolume tiers on the referral program: 7 % above €500 of referred spend, 10 % above €5,000.
• AddedReferral payouts in crypto once earnings exceed €50, to the address you nominate.
• ChangedCommission is calculated on what a referral spends, not on what they top up, so a large deposit no longer pays out before it is used.
• ChangedEarnings land on the balance as they are earned instead of being settled overnight.

• Added34 services in delivery and ride-hailing, including Bolt, Glovo, inDrive, Rappi and Gojek.
• AddedPer-service landing pages with live price, stock and success rate for every country that has numbers for it.
• ChangedThe 24-hour success rate is computed over a rolling window rather than the previous calendar day, so a bad morning shows up before midnight.

• FixedAll-senders rentals dropped messages from alphanumeric sender IDs shorter than three characters.
• FixedRental prices were quoted per day by the API and per term in the dashboard, which disagreed by a few cents on three-month rentals.

• AddedRentals in all-senders mode: receive from any sender, not only from the service you picked.
• Added12 more countries eligible for rental, including Japan, South Korea and Australia.
• ChangedRental prices are quoted per term rather than per day, which is how the upstream actually charges and why short rentals looked oddly expensive.
• FixedDeleting the messages of an activation left the extracted code visible in the activation list.

• AddedUkrainian interface translation, covering the catalogue and the legal pages.
• AddedPer-activation message deletion from the dashboard, ahead of the 30-day retention cut-off.
• ChangedRetention is enforced by a nightly deletion job with an audit record instead of being filtered on read, so expired bodies are actually gone.

• FixedReplaying a webhook delivery re-sent the original timestamp, so endpoints enforcing a five-minute signature tolerance rejected every replay.
• FixedThe uptime strip on the status page rendered 91 bars for visitors in time zones ahead of UTC.

• Added21 countries across the Middle East and the Gulf, including Iraq, Jordan, Lebanon, Oman and Qatar.
• AddedA webhook delivery log with the request, the response status and a manual replay.
• ChangedWebhook secrets can be rotated with a 24-hour overlap during which both the old and the new signature are accepted.

Status page and changelog

• AddedA public status page with 90-day uptime per component and the full incident history.
• AddedThis changelog, with an RSS feed at /changelog.xml.
• ChangedMaintenance windows are announced on the status page at least 48 hours in advance.

• FixedX-VSN-Pool was omitted on responses served from the idempotency cache.
• FixedPool scores were not reset when an operator returned from a maintenance window, so traffic kept avoiding it for hours after it was healthy again.

• FixedThe new scorer treated an operator with fewer than 20 samples as perfectly healthy and sent early traffic to cold ranges. Operators now start at the pool median.
• FixedPurchases returned 503 instead of 409 when every scored operator for a combination was exhausted.

Pool rewrite

Operator selection moved from a per-request provider lookup to a continuously scored pool. Median time to issue a number fell from 2.6 s to 0.9 s.

• ChangedScores are recomputed every 30 seconds for each service, country and operator combination, instead of being looked up at purchase time.
• AddedX-VSN-Pool names the pool that served a purchase, so a failure can be traced back to a range.
• AddedPurchases skip any operator whose trailing 24-hour success rate is below 60 %, even when it is the cheapest.
• RemovedGET /v1/prices?flat=1, deprecated on 2022-08-16. The grouped response replaces it.

• FixedThe / search shortcut hijacked typing inside the promo-code field on the top-up page.
• FixedA key sitting exactly at its daily spend limit returned 500 instead of 402 with a clear error code.

• Added30 services in finance and crypto, including Kraken, Bybit, Bitget, Nubank and Wise.
• AddedSearch across services and countries from any page with the / shortcut.
• ChangedThe pricing page loads the grouped catalogue in one request instead of two, which halved time to first row on slow connections.

• AddedPer-key spend limits, daily and monthly, enforced at purchase time rather than reconciled afterwards.
• AddedGET /v1/me, returning the calling key's scopes, limits and remaining budget.
• ChangedScopes split into numbers:read, numbers:write, balance:read and rentals:write. Existing keys were mapped to the equivalent set with no change in behaviour.

• FixedThe operator name was empty on activations served through the legacy compatibility endpoint.
• FixedArabic-Indic digits appeared in activation countdowns, where tabular Latin digits are used everywhere else.

• AddedA fourth upstream provider. Pool depth in Nigeria, Kenya and Egypt roughly doubled.
• AddedThe operator name is recorded on every completed activation, so a run of failures can be correlated with a specific range.
• ChangedFailover retries a different operator when the first attempt times out, instead of retrying the same one and burning the window.

• FixedCall transcripts longer than 480 characters were truncated with no ellipsis and no truncated flag on the object.
• FixedVoice-to-text delivered the transcript twice when the caller hung up during the beep.

• AddedVoice-to-text on rentals in 11 countries: an inbound call is transcribed and delivered as a message.
• Addedcall.received webhook event, carrying the transcript and the caller ID where the operator provides one.
• AddedRental terms of 3 months.
• DeprecatedGET /v1/prices?flat=1. The grouped response replaces it and carries the same data; the flat shape stops working on 2023-03-15.

• FixedThe dashboard sidebar did not mirror under RTL, so the activation timeline ran off the right edge in Arabic.
• FixedThe Indonesian translation applied the activation status labels to rentals, where the states are different and two of them do not exist.

• AddedHindi, Indonesian and Arabic interface translations, with full right-to-left layout support.
• Added24 countries, mostly Caribbean and Pacific territories.
• ChangedRate limits burst to 20 requests per second within the per-minute budget, instead of rejecting anything above two per second.
• FixedThe stable code field was missing from the 402 returned when the balance is too low.

• AddedAn OpenAPI 3.0 document at /openapi.json, generated from the schema the API validates against.
• AddedOfficial Python and Node clients, dependency-free and thin enough to read in one sitting.
• ChangedError responses carry a stable machine-readable code. The human-readable message is explicitly not stable and should never be parsed.

• FixedActivations for services with an apostrophe in the name failed the legacy getNumber action with BAD_SERVICE.
• FixedThe theme cookie was not read during the first server render, so accounts on the light theme saw a dark flash on every navigation.

• Added19 countries in the Balkans and Eastern Europe — Serbia, Bosnia and Herzegovina, Albania, Moldova, Montenegro and North Macedonia among them.
• ChangedSupport moved to 24/7 cover in English, French, Russian and Spanish. Median first response is now under 12 minutes.
• ChangedThe pricing table groups by service by default, with the country view one click away.

• AddedDark and light themes with a per-account preference, stored in a cookie so the first paint is already correct.
• AddedGerman, Italian and French interface translations.
• ChangedThe activation card shows the full SMS body next to the extracted code, not only the code.

• FixedThe balance-low alert fired on every purchase once the threshold was crossed, instead of once per crossing.
• Fixedbalance.low webhooks were sent before the debit was committed, so the payload showed the pre-purchase balance.

• AddedBalance-low email alert with a per-account threshold.
• Addedbalance.low webhook event.
• Added40 services, including Revolut, Binance, OKX and Coinbase.

• AddedA third upstream provider, adding depth in India, Indonesia and Bangladesh.
• AddedA seven-day stock history on each pricing row, so you can see whether a country is drying up before you plan around it.
• ChangedRouting weighs price against the trailing success rate instead of picking on price alone. Slightly more expensive numbers that actually deliver now win.
• FixedA pool refresh could briefly report zero stock for every Indian service.

• FixedIPv6 allowlist entries carrying a zone identifier were rejected as malformed.
• FixedThe seven-day stock history bucketed by the account time zone but labelled the axis in UTC.

• AddedIP allowlists on API keys, accepting IPv4, IPv6 and CIDR ranges, one per line.
• AddedTurkish, Polish and Vietnamese interface translations.
• ChangedAPI keys are shown once at creation and only a prefix is stored afterwards. Existing keys were rotated and the old values are no longer retrievable by anyone, including us.

• AddedIdempotency keys on POST /v1/activations. A replay within 24 hours returns the original response instead of buying a second number.
• AddedLong-polling on GET /v1/activations/{id} with wait= up to 180 seconds, so tight polling loops are no longer necessary.
• ChangedWebhook retries use exponential back-off across 24 hours over eight attempts, instead of five attempts inside an hour.

• FixedWebhook signatures were computed over the parsed body, so endpoints that re-serialised the JSON before verifying saw a mismatch.
• FixedRentals bought in the hour before a daylight-saving change expired 60 minutes early.
• FixedAuto-renew debited the balance even when the upstream lease could not be extended. The affected charges were credited back the same week.

Number rental

Keep the same number from four hours to one month and receive unlimited SMS from the service you choose.

• AddedRentals with terms of 4 hours, 12 hours, 1 day, 3 days, 1 week and 1 month.
• AddedPOST /v1/rentals and GET /v1/rentals/{id}, with optional auto-renew six hours before expiry.
• AddedRental available in 15 countries in the first wave, including the United Kingdom, France, Germany, Spain, Poland, Canada and the United States.

• AddedWebhooks: sms.received, activation.completed and activation.expired, signed with HMAC-SHA256 over the raw body.
• AddedGET /v1/countries and GET /v1/services catalogue endpoints.
• ChangedDefault rate limit raised from 60 to 120 requests per minute per key.

• FixedLive activation cards stopped updating after the tab had been in the background for more than five minutes.
• FixedThe language-prefix redirect dropped the query string, which broke referral links carrying ?ref=.

New dashboard

The dashboard was rebuilt around live activation cards, so a code appears the moment it lands rather than on the next refresh.

• AddedLive activation cards with the countdown, the full SMS body and one-click copy for both the number and the code.
• ChangedThe interface language is part of the URL (/en/, /ru/), so every page is linkable and shareable per language.
• ChangedActivation objects gained smsText, receivedAt and operator. Existing fields are unchanged.
• ChangedPrices and stock refresh every 60 seconds in the browser without a page reload.

• Added26 countries across Central Asia and the Caucasus, including Kazakhstan, Uzbekistan, Georgia, Armenia and Azerbaijan.
• AddedCSV export of activation history, capped at 5,000 rows per file.
• FixedKazakh numbers were displayed with the +7 country code split in the wrong place.

• AddedA second upstream provider in the pool, with per-service health scoring and automatic failover.
• AddedCountry-level success-rate badges on the pricing page, computed over the trailing 24 hours.
• ChangedThe first top-up minimum moves from €10 to €30, announced by email on 2020-12-08. Existing balances are unaffected and repeat top-ups stay at €10.
• FixedSuccess-rate badges rounded 84.6 % up to 85 % and crossed the healthy threshold visually while the real rate had not.

• FixedReferral attribution was lost when a visitor switched language before signing up.
• FixedThe activation countdown drifted by up to 40 seconds in tabs left in the background.
• FixedRecovery codes could be redeemed twice if two requests arrived within the same second.

• AddedReferral program: 5 % of referred spend, credited to balance as it is earned.
• AddedSpanish, Portuguese and Chinese interface translations.
• ChangedDefault rate limit raised from 30 to 60 requests per minute per key.

• AddedTwo-factor authentication with TOTP and ten single-use recovery codes.
• AddedAn active-session list in Settings, with per-device sign-out.
• ChangedSessions are bound to a rotating token, so a stolen cookie stops working at the next rotation.

• FixedInvoice PDFs rendered Cyrillic company names as empty boxes.
• FixedThe code extractor missed four-digit codes wrapped in non-breaking spaces, which two Brazilian senders use.

• AddedPDF invoices for every top-up, with optional company details on the document.
• Added31 services, including Bumble, Signal, Grindr and Airbnb.
• ChangedActivation history keeps the full SMS body for 30 days instead of the extracted code alone.

• AddedMulti-SMS mode: keep an activation open for further messages from the same service, billed at 30 % of the base price per extra message.
• Added18 African countries, including Nigeria, Kenya, Ghana, South Africa, Egypt and Morocco.
• ChangedRate-limit headers are returned on 429 responses, so back-off logic has something to read.

• FixedsetStatus with status 8 released the number but left the order marked as waiting for about 90 seconds.
• FixedCancelling an activation twice within the same second credited the refund twice.

handler_api compatibility

• AddedA compatibility endpoint that speaks the classic handler_api protocol, so existing scripts run unchanged with only the api_key swapped.
• AddedgetBalance, getNumber, getStatus and setStatus, returning the original ACCESS_ and STATUS_ tokens.
• ChangedAPI keys are stored hashed. Existing keys were rotated and the plaintext is no longer retrievable.

• FixedGET /v1/prices returned services with zero stock when available=true was passed.
• FixedLong service names overflowed the activation card on screens narrower than 380 px.

• Added22 countries across Latin America and South-East Asia, including Brazil, Colombia, Peru, Vietnam and the Philippines.
• AddedEmail notification when a code arrives, opt-in per account.
• ChangedPrices and stock refresh every 60 seconds instead of every five minutes.

• FixedStock counters for Indonesia showed the provider's whole pool instead of the subset registered as Telegram-capable.
• FixedPassword reset links expired after 15 minutes rather than the documented 60.

• AddedRussian interface translation, including the catalogue and the support forms.
• AddedGET /v1/prices, returning live price and stock per country for a service.
• AddedA per-service success rate over the trailing 24 hours, shown on every price row.

• AddedNine countries: Poland, Romania, Portugal, Czechia, Hungary, Bulgaria, Croatia, Slovakia and Lithuania.
• AddedDiscord, Tinder, Steam and Yandex.
• AddedUSDT-ERC20 and Litecoin as top-up currencies.
• ChangedThe activation window is 20 minutes, up from 15, after measuring how long real delivery tails actually run.

• FixedActivations bought between 00:00 and 00:05 UTC were billed against the previous day's price snapshot.
• FixedAn OxaPay callback for a Bitcoin deposit could be replayed into a duplicate credit when the first callback timed out.
• ChangedBalance is credited on the first network confirmation instead of the third.

Public launch

VirtualSMSNumbers opens to the public with one-time activations in 14 countries and a prepaid balance funded in crypto.

• AddedOne-time SMS activations across 14 countries and 40 services.
• AddedA prepaid balance in euros, funded with BTC and USDT-TRC20 through OxaPay.
• AddedPOST /v1/activations and GET /v1/activations/{id}, authenticated with a bearer key.
• AddedAutomatic refund to balance when no message arrives inside the 15-minute activation window, with no ticket to open.