Opens in a new tab
New
SMS MCP server: Let your AI agents send SMS and voice messages
Learn more
SMS REST API · Version 2

SMS API for
Developers.

SMS, voice messages, and verification codes via REST

The LOX24 SMS API connects your application to 880 mobile networks worldwide. Through a REST interface with JSON, you send SMS and voice messages, receive replies via webhook, and send verification codes, operated exclusively on servers in Europe.

  • REST + JSON
  • 99.9% availability
  • Webhooks
  • Servers in Germany
Key facts
REST · HTTP · MAIL · SOAP · KANNEL
What is an SMS API?

What is an SMS API?

An SMS API is a programming interface that lets software send and receive SMS automatically. Your application sends an HTTP request with the recipient and text, and the provider delivers the message to the mobile network through its SMS gateway. You get a confirmation back, and later a delivery report. With the LOX24 SMS API, you can also control the sender, send time, character set, and voice output for each message.
02 · FEATURES

What features does the SMS API offer?

Our SMS API enables bulk sending of text messages, creation of personalized messages, automatic receipt of replies, and tracking of delivery reports. Security and data protection are our highest priority.
03 · INTEGRATION

How easy is it to integrate the SMS API?

Our SMS API enables simple, fast integration into your existing systems and applications. We provide clear multilingual documentation with code examples, as well as technical support.
NETWORKS
880 networks worldwide
THROUGHPUT
10SMS / second
Compatible with all modern programming languages
curl
php
go
c#
python
java
javascript
ruby
curl
php
go
c#
python
java
javascript
ruby
Basics

Authentication and endpoints of the LOX24 SMS API

 

All requests go to https://api.lox24.eu and are authenticated via the header X-LOX24-AUTH-TOKEN . The token consists of your user ID and an API key (:), which you create in your customer account. Requests and responses use JSON. After three failed login attempts within one minute, the API blocks the requesting IP for ten minutes.

BASE URLhttps://api.lox24.euHeader: X-LOX24-AUTH-TOKEN

Area
Endpoint
Purpose
SMS

POST/sms

Send SMS or voice message

POST/sms/dryrun

Test sending without actually sending

GET/sms

Retrieve sent SMS and status
Bulk messaging

POST/bulks

Thousands of recipients in a single request
Inbox

GET/incomings

Retrieve received SMS
Verification

POST/verify_codes

Code via Telegram, voice call, or SMS
Contacts

/groups/phones/blocked_numbers

Manage distribution lists and blocklists
Campaigns

/campaigns/links

Short links with click tracking
Account

GET/me

Account information and balance

You can find all endpoints with examples in the API Documentation. The OpenAPI specification can be loaded directly into Postman, Insomnia, or a code generator.

Send and receive SMS with just a few lines of code

Code examples for curl, PHP, Python, Java, Go, C#, and JavaScript

The LOX24 SMS API works with any language that can send HTTP requests. Here you can see how to send an SMS in seven languages, each with error handling via HTTP status codes.
#!/usr/bin/env bash
curl -X POST https://api.lox24.eu/sms \
  -H 'Content-Type: application/json' \
  -H 'X-LOX24-AUTH-TOKEN: 1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx' \
  -d '{
    "sender_id": "My Sender",
    "phone": "+49751234567",
    "source": 111,
    "service_code": "direct",
    "text": "Test message",
    "delivery_at": 1573724611,
    "is_unicode": true,
    "callback_data": "123456",
    "voice_lang": "DE"
}'
'My Sender',
    'text' => "First line\nSecond line",
    'service_code' => 'direct',
    'phone' => '+49751234567',
    'delivery_at' => 1573724611,
    'is_unicode' => true,
    'callback_data' => '123456',
    'voice_lang' => 'DE',
];

if(!$body = json_encode($body)) {
    die('JSON encoding error!');
}

$curl = curl_init();
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_URL => $uri,
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_HTTPHEADER => [
        "X-LOX24-AUTH-TOKEN: {$token}",
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
]);

$response = curl_exec($curl);
$code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

$data = json_decode($response, JSON_OBJECT_AS_ARRAY);

if(201 === $code) {
    echo 'Success: response data = ' . var_export($data, true);
} else {
    echo "Error: code = {$code}, data = " . var_export($data, true);
}
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io/ioutil"
	"log"
	"net/http"
)

func main() {
	const Method = "POST"
	const URL = "https://api.lox24.eu/sms"
	const Token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx"

	payload := map[string]interface{}{
		"sender_id":     "My Sender",
		"phone":         "+49751234567",
		"source":        111,
		"service_code":  "direct",
		"text":          "Test message",
		"delivery_at":   1593724611,
		"is_unicode":    true,
		"callback_data": "123456",
		"voice_lang":    "DE",
	}

	jsonPayload, _ := json.Marshal(payload)
	client := &http.Client{}

	req, err := http.NewRequest(Method, URL, bytes.NewBuffer(jsonPayload))
	if err != nil {
		log.Fatal(err)
	}

	req.Header.Add("X-LOX24-AUTH-TOKEN", Token)
	req.Header.Add("Content-Type", "application/json")

	res, err := client.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer res.Body.Close()

	body, err := ioutil.ReadAll(res.Body)
	if err != nil {
		log.Fatal(err)
	}

	switch res.StatusCode {
	case 201:
		fmt.Println((string(body)))
	case 400:
		fmt.Println("Error: code = 400 - Invalid input")
	case 401:
		fmt.Println("Error: code = 401 - Client ID or API key isn't active or invalid!")
	case 403:
		fmt.Println("Error: code = 403 - Account isn't activated. Please wait or contact to support!")
	default:
		fmt.Printf("Error: code = %d\n", res.StatusCode)
	}
}
using Newtonsoft.Json;
using System;
using System.IO;
using System.Net;
using System.Text;

namespace Lox24.Api
{
    class client
    {
        static void Main()
        {
            string key = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx";
            string url = "https://api.lox24.eu/sms";

            var data = new {
                sender_id = "My Sender",
                text = "Test message",
                service_code = "direct",
                phone = "+49751234567",
                delivery_at = 1573724611,
                is_unicode = true,
                callback_data = "123456",
                voice_lang = "DE"
            };

            string postdata = JsonConvert.SerializeObject(data);

            var httpWebRequest = (HttpWebRequest)WebRequest.Create(url);
            httpWebRequest.ContentType = "application/json; charset=utf-8";
            httpWebRequest.Accept = "application/json";
            httpWebRequest.Method = "POST";
            httpWebRequest.Headers.Add("X-LOX24-AUTH-TOKEN", key);

            using (var streamWriter = new StreamWriter(httpWebRequest.GetRequestStream()))
            {
                streamWriter.Write(postdata);
            }

            using (HttpWebResponse resp = (HttpWebResponse)httpWebRequest.GetResponse())
            {
                if (resp.StatusCode == HttpStatusCode.Created)
                    Console.WriteLine("Success: sms resource created");
            }
        }
    }
}
import json
import requests

token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx"
url = 'https://api.lox24.eu/sms'

data = {
    'sender_id': "My Sender",
    'text': "Test message",
    'service_code': "direct",
    'phone': "+49751234567",
    'delivery_at': 1573724611,
    'is_unicode': True,
    'callback_data': '123456',
    'voice_lang': 'DE'
}

headers = {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'X-LOX24-AUTH-TOKEN': token,
}

try:
    # timeout is 100 seconds, the payload is automatically converted to json
    res = requests.post(url, headers=headers, json=data, timeout=100)
    if res.status_code != 201:  # Created
        print("Error: Wrong response code on create sms")
        res.raise_for_status()
    else:
        print(f'Success: code = {res.status_code} - sms resource created')
        print("Response: ", json.dumps(res.json(), indent=4))
except requests.HTTPError:
    if res.status_code == 400:
        print("Error:400 Invalid input")
    elif res.status_code == 401:
        print("Error: code = 401 - Client ID or API key isn't active or invalid!")
    elif res.status_code == 402:
        print("Error:402 There are not enough funds on your account!")
    elif res.status_code == 403:
        print("Error: code = 403 - Account isn't activated!")
package eu.lox24.doc.sms;

import org.json.JSONObject;

import java.net.HttpURLConnection;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public class PostSmsCollection {

    public static void main(String[] args) {

        var key = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx";
        var url = "https://api.lox24.eu/sms";

        var json = new JSONObject();
        json.put("sender_id", "My Sender");
        json.put("text", "Test message");
        json.put("service_code", "direct");
        json.put("phone", "+49751234567");
        json.put("delivery_at", 1573724611);
        json.put("is_unicode", true);

        var httpRequest = HttpRequest.newBuilder(URI.create(url))
                .timeout(Duration.ofMillis(100000))
                .setHeader("Content-Type", "application/json; charset=utf-8")
                .setHeader("Accept", "application/json")
                .setHeader("X-LOX24-AUTH-TOKEN", key)
                .POST(HttpRequest.BodyPublishers.ofString(json.toString()))
                .build();

        var client = HttpClient.newBuilder()
                .version(HttpClient.Version.HTTP_1_1)
                .build();

        try {
            var httpResponse = client.send(httpRequest, HttpResponse.BodyHandlers.ofString());
            if (httpResponse.statusCode() == HttpURLConnection.HTTP_CREATED) {
                System.out.println("Success: sms resource created");
                System.out.println(httpResponse.body());
            } else {
                System.out.println("Error: wrong response code " + httpResponse.statusCode());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
/*
 * Post sms
 */
const token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx";

var postObj = {
    sender_id: 'My Sender',
    text: 'Test message',
    service_code: 'direct',
    phone: '+49751234567',
    delivery_at: 1573724611,
    is_unicode: true,
    callback_data: "123456",
    voice_lang: "DE"
};

var postdata = JSON.stringify(postObj);

const https = require('https');
const options = {
    hostname: 'api.lox24.eu',
    path: '/sms',
    method: 'POST',
    headers: {
        'Accept': 'application/json',
        'Content-Type': 'application/json',
        'Content-Length': postdata.length,
        'X-LOX24-AUTH-TOKEN': token
    }
}

const req = https.request(options, res => {
    if (res.statusCode == 201) {
        console.log("Success: code = 201 - sms resource created");
        res.on('data', d => { process.stdout.write(d) })
    }
    else if (res.statusCode == 400) console.log("Error: code = 400 - Invalid input");
    else if (res.statusCode == 401) console.log("Error: code = 401 - API key isn't active or invalid!");
    else if (res.statusCode == 402) console.log("Error: code = 402 - Not enough funds on your account!");
})

req.on('error', error => { console.error(error) })
req.write(postdata);
req.end();

PARAMETERS FOR POST /sms · JSON

Parameters
Type
Description
phone
string

Recipient number in international format, e.g. +49151…

text
string

Message text. Longer texts are split across multiple SMS.

sender_id
string

Sender: text of up to 11 characters or a phone number of up to 15 digits.

service_code
string

Delivery type, e.g. direct (default) or text2speech for voice messages.

delivery_at
integer

Send time as a Unix timestamp, for scheduled SMS.

is_unicode
boolean

true for emojis and special characters (UCS-2); otherwise the GSM character set is used.

callback_data
string

Custom identifier, e.g. an order number. Returned in the delivery report.

voice_lang
string

Language of the voice message, e.g. DE. If not specified, the API detects the language automatically (20 languages).

You can find all parameters, required fields, and response formats in the API Documentation.

API Documentation
SMS API for Your App

SMS API Even Without a Developer

Want to benefit from the LOX24 SMS API for your business but don't have a developer to help you? No problem. We have the solution. With our Zapier integration, you can easily connect your software to our API without any programming knowledge. You don't need any support from your IT department.

  • More than 6,745 applicationsWith our SMS API solution, you can use Zapier to communicate with more than 6,745 applications that you use for your business.
  • SMS Gateway for Your AppMany applications already support SMS sending with LOX24 out of the box, e.g. Bitrix24, Theorg, and Synology.
  • No programming knowledge requiredYou don't need any support from your IT department.
Applications

What you can build with the LOX24 SMS API

 

One API, many use cases: from login codes and shipping updates to campaigns with click tracking, all functions run through the same interface, the same API key, and the same billing.

Two-factor authentication

Send verification codes for login, registration, and payments. You define a channel order, for example Telegram, then voice call, then SMS. If the code doesn't arrive, LOX24 automatically tries the next channel.

POST /verify_codes

Automatic notifications

Your software informs customers and employees the moment something happens: order shipped, appointment tomorrow, server down. With delivery_at you schedule messages in advance, and with callback_data you match each delivery report to its transaction.

POST /sms

Bulk SMS and campaigns

Send thousands of personalized SMS with a single request, to number lists or saved groups. Short links with click tracking show you who responded to your offer.

POST /bulks · /campaigns

Two-way conversations

With a virtual number, recipients can reply. Every incoming SMS is delivered to your application via webhook, for example as an appointment confirmation, callback request, or ticket reply. Opt-outs via "STOP" are processed automatically.

GET /incomings · Webhook

Fraud check before sending

Check orders and registrations before you trigger an SMS. The anti-fraud API detects anonymous VPNs and suspicious data and returns a risk score. This protects you from fraud and costly SMS pumping.

Fraud check API

SMS from AI agents

With the LOX24 MCP server, AI assistants such as Claude or Cursor can use the API directly: send SMS and voice messages, read incoming SMS, check your balance. All you need is your API key.

MCP server
For developers

What else the LOX24 SMS API can do

 

Besides sending, the LOX24 SMS API offers everything an integration needs day to day: webhooks, test mode, blocklists, and queries for pricing and your account.

Delivery reports via webhook
For every SMS, LOX24 reports the status to your application via webhook (sms.delivery), including your callback_data. If your server is briefly unreachable, LOX24 automatically retries the delivery.
Incoming SMS via webhook
Replies to your virtual number arrive in your application immediately, with sender, text, and timestamp. Alternatively, you can retrieve them via GET /incomings .
Test sending with dryrun
With POST /sms/dryrun lets you test your integration without sending a real SMS. The API responds as it does in live operation and sends a simulated delivery report.
Cancel scheduled SMS
With delivery_at you can schedule SMS in advance, such as appointment reminders. If the appointment is canceled, you can simply cancel the unsent SMS via the API.
Blocklists
With /blocked_numbers you define numbers that should never receive an SMS again, for example after an opt-out or a complaint. The gateway automatically blocks them on every send.
Automatic opt-ins and opt-outs
When a contact opts in or out via SMS keyword or form, LOX24 notifies your application via webhook. This keeps your CRM and distribution lists up to date without manual work.
Short links with click tracking
Links in your SMS are sent as short links and tracked. Via the API, you can retrieve which SMS were clicked and how often.

Pricing and account via API
With /me/pricelist/{country} lets you query your current prices by country, for example to calculate costs before sending. Invoices and payments can also be retrieved via the API.

Protection against attacks
After three failed login attempts within one minute, the API blocks the requesting IP for ten minutes (HTTP 429). You can also restrict access to your own servers using an IP allowlist.

FAQ

Frequently asked questions about the LOX24 SMS API

With every request, you send the header X-LOX24-AUTH-TOKEN with the value :. You create the API key in your LOX24 customer account. You can also restrict access to your servers using an IP restriction.

 

Yes. The complete specification of the LOX24 API v2 is available at doc.lox24.eu/openapi-en.json. You can import it into Postman or Insomnia, or use it to generate a client in your language.

 

Yes, via the endpoint POST /sms/dryrun. It validates your request as in live operation and triggers a simulated delivery report, without any SMS being sent.

 

In international format with country code, for example +49151… for a German mobile number.

 

You set service_code on text2speech. LOX24 calls the recipient and reads the text aloud. You specify the language with voice_lang , or the API detects it automatically from the text (20 languages).

 

Via the endpoint /verify_codes. There you define a sequence of channels, for example Telegram first, then voice call, and SMS last. If the code doesn't arrive on one channel, LOX24 automatically tries the next.

The API is a lean REST interface; code examples for seven languages and the OpenAPI specification are all you need for integration. For Symfony, there is a ready-made Notifier transport.

Full API documentation

The LOX24 API documentation contains all endpoints, parameters, and status codes with examples, plus the webhook formats for delivery reports and incoming SMS. You can import the OpenAPI specification directly into Postman or Insomnia.
API DocumentationOpenAPI specification

Create an API key now and send your first SMS

Sign up for free, create your API key in your customer account, and test the integration with a dry run. You'll get a starting credit of 50 cents for your first real SMS.

NO BASE FEE
99.9% AVAILABILITY
GERMAN DATA PROTECTION
UNCOMPROMISING SECURITY