xcrypt API

1. Get a key

Create an account or log in, then make a key on your Account page. Send it with every request in the X-Api-Key header. Keep it secret: anyone who has it can spend your balance. You can replace or revoke it at any time.

2. Base URL

https://xcrypt.tech/api/v1

Requests and responses are JSON. Errors come back with an HTTP status and { "error": "..." }.

Your balance in USD.

{ "balance": 4.87, "currency": "USD" }

Every service you can buy, with the lowest price and how many countries have numbers.

{ "services": [ { "code": "whatsapp", "name": "WhatsApp", "price_from": 0.13, "countries": 122 } ] }

Countries for one service, with your price in each.

{ "service": "whatsapp", "countries": [ { "code": "usa", "name": "United States", "price": 0.13, "available": 812 } ] }

Operators for one service and country. Leave the operator out when buying and the most reliable one is picked.

{ "service": "whatsapp", "country": "usa", "operators": [ { "operator": "virtual58", "price": 0.13, "available": 312 } ] }

Buy a number. The price is taken from your balance right away.

{ "service": "whatsapp", "country": "usa" }

{ "order": { "id": 1042, "phone": "+15550123", "status": "PENDING", "code": null, ... }, "balance": 4.74 }

Check an order. Poll every 5 seconds until code is set or the status is final.

{ "order": { "id": 1042, "status": "RECEIVED", "code": "482913", "sms_text": "Your WhatsApp code: 482-913", ... }, "balance": 4.74 }

Cancel before a code arrives. You are refunded automatically.

{ "order": { "id": 1042, "status": "CANCELED", "refunded": true, ... }, "balance": 4.87 }

Close an order once you have your code.

{ "order": { "id": 1042, "status": "FINISHED", ... } }

Report a number that does not work. You will never get it again, and if no code arrived you are refunded.

{ "order": { "id": 1042, "status": "BANNED", "refunded": true, ... } }

Your latest orders (up to 100). status=active returns only orders still waiting.

{ "orders": [ ... ] }

• PENDING number given, waiting for the SMS
• RECEIVED a code arrived (see code and sms_text)
• FINISHED closed with a code
• CANCELED, TIMEOUT, BANNED, FAILED closed without a code and refunded (refunded: true)

curl -X POST https://xcrypt.tech/api/v1/orders \
  -H "X-Api-Key: tpk_your_key" \
  -H "Content-Type: application/json" \
  -d '{"service":"whatsapp","country":"usa"}'

import time, requests

API = "https://xcrypt.tech/api/v1"
H = {"X-Api-Key": "tpk_your_key"}

order = requests.post(f"{API}/orders", json={"service": "whatsapp", "country": "usa"}, headers=H).json()["order"]
print("Number:", order["phone"])

while order["status"] == "PENDING":
    time.sleep(5)
    order = requests.get(f"{API}/orders/{order['id']}", headers=H).json()["order"]

print("Code:", order["code"])  # None if it timed out (you were refunded)

Instead of polling, give us a URL and we POST to it the moment a code arrives (order.code) and when an order closes (order.closed, with refunded set if it was refunded). Each event is sent once, retried twice if your URL does not answer with a 2xx, and open orders are checked about every 10 seconds.

Set it on your Account page or with the API:

curl -X POST https://xcrypt.tech/api/v1/webhook -H "X-Api-Key: tpk_your_key" \
  -H "Content-Type: application/json" -d '{"url":"https://yourbot.example/telly"}'
# -> { "url": "...", "secret": "whsec_..." }     DELETE /webhook turns it off

POST https://yourbot.example/telly
X-Telly-Event: order.code
X-Telly-Signature: sha256=<HMAC-SHA256 of the raw body with your secret>

{ "event": "order.code", "order": { "id": 1042, "status": "RECEIVED", "code": "482913", ... }, "sent_at": "..." }

import hmac, hashlib
expected = "sha256=" + hmac.new(SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, request.headers["X-Telly-Signature"]):
    abort(401)

Bots and tools written for SMS-Activate work here without code changes. Point them at this address and use the same API key:

https://xcrypt.tech/stubs/handler_api.php?api_key=tpk_your_key&action=getBalance

Supported actions

• getBalance, getNumber, getNumberV2 (with maxPrice and operator), getStatus
• setStatus with status 1 (ready), 6 (done) or 8 (cancel and refund)
• getPrices, getCountries, getActiveActivations

SMS-Activate service codes (wa, tg, go…) and numeric country ids (187 for USA, 16 for UK…) are translated for you, and this store's own codes (whatsapp, usa) work too. A country or service this store doesn't sell answers BAD_COUNTRY or BAD_SERVICE, so you are never charged for the wrong number. Requesting another SMS (status 3) is not available.

120 requests a minute per key, of which 30 can be purchases. Over the limit you get HTTP 429 and can retry after a minute.