How to get an API key and send your first SMS with curl and PHP

The iSend API sends SMS from any system of yours with a single HTTP call. Authentication uses an API Token that you create in the platform's Developers menu and send as a Bearer token in the Authorization header. Sending is a POST to https://sms.isend.gr/api/http/sms/send with a JSON body containing the recipient, the sender and the message. The response returns the message identifier, which you use later to check the delivery status.

How to get the API Token

1. Log in to the platform and open the Developers menu.
2. In the API Token card click the reveal button and then Copy. Store it in your system's configuration, not in a file that others can see.
3. If you lose it or suspect it has leaked, click Regenerate token. The new one is shown once, copy it immediately. The old one stops working.

The token gives access to your whole account: sends, contacts, balance. Never put it in code that runs in the visitor's browser or in a mobile app. Calls are made from your own server.

The send call

POST https://sms.isend.gr/api/http/sms/send
Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json
Accept: application/json

Example with curl

curl -X POST https://sms.isend.gr/api/http/sms/send \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "recipient": "306912345678",
    "sender_id": "MyShop",
    "message": "Η ΠΑΡΑΓΓΕΛΙΑ 1042 ΕΦΥΓΕ ΣΗΜΕΡΑ. ΠΑΡΑΔΟΣΗ ΑΥΡΙΟ.",
    "transactional": true
  }'

The message in the examples is Greek ("Order 1042 shipped today. Delivery tomorrow."), written in uppercase without accents, which is how Greek text is sent, as noted in the table above.

Example in PHP

<?php
$payload = [
    'recipient'     => '306912345678',
    'sender_id'     => 'MyShop',
    'message'       => 'Η ΠΑΡΑΓΓΕΛΙΑ 1042 ΕΦΥΓΕ ΣΗΜΕΡΑ. ΠΑΡΑΔΟΣΗ ΑΥΡΙΟ.',
    'transactional' => true,
];

$ch = curl_init('https://sms.isend.gr/api/http/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('ISEND_API_TOKEN'),
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($payload, JSON_UNESCAPED_UNICODE),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($response['status'] ?? '') === 'success') {
    $uid = $response['data']['uid'];   // keep it for the status check
} else {
    error_log('iSend: ' . ($response['message'] ?? 'unknown error'));
}

The token is read from an environment variable, not from the file itself. In WordPress or Laravel you put it in the project's configuration file.

The response

Successful send:

{
  "status": "success",
  "data": {
    "uid": "6415907d0d7a6",
    "to": "306912345678",
    "from": "MyShop",
    "message": "Η ΠΑΡΑΓΓΕΛΙΑ 1042 ΕΦΥΓΕ ΣΗΜΕΡΑ. ΠΑΡΑΔΟΣΗ ΑΥΡΙΟ.",
    "cost": 1,
    "sms_count": 1,
    "status": "Sent"
  },
  "message": "Sent"
}

sms_count is the number of parts, that is the credits charged. uid is the identifier for the status check. When sending to multiple numbers, the call creates a campaign and returns its details.

Error:

{"status": "error", "message": "The recipient field is required."}

The common errors are a wrong or expired token, an empty or wrong field, a Sender ID that is not active on the account, and insufficient balance. The text in message tells you which one it is.

Status and balance checks

The delivery status is updated when the report arrives from the network, usually within a few seconds:

GET https://sms.isend.gr/api/http/sms/{uid}
Authorization: Bearer YOUR_API_TOKEN

The response contains customer_status with the same values you see in the Reports: Sent, Delivered, Undelivered, Failed, Expired, Rejected. The article about delivery statuses explains each one. For messages that end in failure the credits are returned automatically.

The account's credit balance:

GET https://sms.isend.gr/api/http/balance
Authorization: Bearer YOUR_API_TOKEN

Useful for notifying your system before the credits run out.

What else the API does

With the same token you manage contacts and groups, for example you add a new customer to a group the moment they sign up in your system. The article about contact groups has the call. The full documentation, with all the endpoints for contacts, groups, campaigns, templates and reports, is inside the platform, in the Developers menu, with examples that already contain your own address.

Five rules for a proper integration

• Send transactional messages with transactional: true and advertising messages without it. Advertising content flagged as transactional violates the consent of opted-out recipients.
• Keep the uid of every send in your database, so you can check what was delivered.
• Do not automatically resend on failure without looking at the cause. A wrong number fails every time.
• The limit is 30 send calls per minute per token. For many recipients with the same message, put the numbers comma-separated in one call instead of one call per number.
• For advertising messages, first add the recipient as a contact in a group and then send. This way the message gets the STOP opt-out link and the platform respects those who have already opted out.
• Test on your own mobile number first. The trial account with its 50 SMS covers a complete integration.

Frequently asked questions

Is the call charged if the message is not sent?

No. Only messages that are delivered to the network are charged, and those that end in a failure status return their credits automatically. A call that is rejected because of a wrong field or a wrong token charges nothing.

Can I send to multiple numbers with one call?

Yes. Put the numbers in the recipient field separated by commas. The platform creates a campaign and sends the same message to everyone. For different text per recipient, make separate calls or use personalization tags for contacts that exist in your lists.

Which programming language does it work with?

Any language that makes HTTPS calls with JSON: PHP, Python, Node.js, C#, Java, or even an automation tool such as Make or n8n. All it needs is the Authorization header with the token and the JSON body.