Verifying +387 Sign-Ups When Nobody on the Team Holds a Bosnian SIM

Our release needs a +387 test, but the SIM is in a drawer in Sarajevo. What now?

This is a common bind for teams shipping to the Western Balkans. The product manager wants proof that Bosnian users can register, the QA lead has a checklist item that says "verify with a local number", and the only physical +387 SIM belongs to a colleague who left last spring.

The usual reasons a team ends up here:

• A regional launch covering Bosnia and Herzegovina alongside Croatia, Serbia and Montenegro, where each market's sign-up path needs its own check.
• Diaspora customers. Many people living in Germany, Austria, Sweden and elsewhere still keep a +387 number, so a fintech or telecom-adjacent product may see Bosnian numbers from users who never set foot in the country during onboarding.
• Localisation QA. Bosnian, Croatian and Serbian are all official languages, and both Latin and Cyrillic scripts appear in daily use, so copy and form validation deserve a real end-to-end pass.

Instead of mailing SIM cards around, OTP Route handles the OTP routing for you: the OTP Gateway hands you a +387 number for a single verification and passes the incoming SMS back through an SMS verification API your test harness can call.

Which apps and platforms can send codes to a Bosnian verification number?

Coverage is a live snapshot, so treat this as a starting point rather than a fixed menu. At the time of writing, routes for Bosnia and Herzegovina include Viber, WhatsApp, Telegram, Google (Gmail & YouTube), Facebook, Instagram, TikTok, Signal, Microsoft & Outlook, LinkedIn, Discord, Uber, Amazon and eBay.

In total the country carries more than 1,600 services. If you need a Bosnia and Herzegovina verification number for a service not shown here, check the live list first. Viber matters more in the Balkans than in many other regions, which is worth remembering if your own product sends codes through messaging channels as well as SMS. Because availability shifts through the day, ask the API for current options instead of hard-coding a list in your test suite.

How does the Bosnia and Herzegovina OTP API flow run, call by call?

For Bosnian tests, point your client at https://otproute.com/api/v1 and pass an or_live_ key as the Bearer token. Keys are created in the Developer console; an account can hold up to 10 keys and 5 webhook endpoints, with a ceiling of 300 requests per minute.

1. Call GET /api/v1/services and GET /api/v1/countries once, cache the ids, and confirm ba is listed.
2. Check cost with GET /api/v1/prices?country=ba&service=<id> so your job logs the exact figure before spending.
3. Send POST /api/v1/activations with {"service": "<id>", "country": "ba"}. The response carries the activation id and the +387 number to type into the app under test.
4. Wait for the activation.sms_received webhook, or poll GET /api/v1/activations/{id} at a modest interval if your runner cannot accept inbound traffic.
5. If the test aborts, release the number with POST /api/v1/activations/{id}/cancel so the funds return straight away.

For webhooks, read the X-OTPRoute-Signature header (t=<unix>,v1=<hex>), compute HMAC-SHA256 over <t>.<raw body> with the endpoint secret, compare in constant time, and drop stale timestamps. Because events are keyed on the activation id, a +387 code delivered twice should be written only once. The OTP API integration guide walks through retries and error handling in more depth.

Is there a no-code way for the support or ops team?

Yes. Someone without API access can do the same thing from the browser: sign in, open the OTP Gateway, choose Bosnia and Herzegovina and the service, read the price, and confirm. The number appears on screen, and the code shows up next to it once the SMS is received. This suits a support agent reproducing a customer's registration problem or an operations lead checking a partner portal after a phone change.

How should we store +387 numbers and parse Bosnian SMS text?

Domestically, Bosnian numbers are dialled with a trunk prefix of 0, and mobile numbers typically start with 06. In E.164 that zero disappears: a number written locally as 061 followed by six digits becomes +387 61 plus those six digits. Store the E.164 form only, strip spaces, dashes and slashes on input, and reject anything that still carries the leading zero after the country code.

Verification texts may arrive in English or in one of the local languages, and a message written in Cyrillic is entirely possible. Extract the code with a digit pattern rather than by searching for a specific word, and make sure your logging keeps UTF-8 intact so diacritics such as č, ć, š and ž are not mangled when you debug a failed run.

What if a test run never receives the code?

Nothing is charged when a code fails to arrive. If no SMS lands within 20 minutes, or you cancel first, the full amount returns to the wallet automatically. When that happens:

• Let the window run its course instead of re-ordering immediately; a late SMS still counts.
• Try again a little later, or pick a different service route for the same scenario.
• Confirm that the target service accepts virtual numbers at all; some refuse them, which is exactly why the refund exists.
• Avoid ordering in a tight loop from CI, which burns rate limit without improving the odds.

Reducing failed OTP deliveries covers the patterns that tend to help.

Can we keep a Bosnian line long term, and how does billing work?

Not as a self-serve product. Dedicated Virtual Numbers, which renew from the wallet from $1.95/month, are sold instantly only for the United States and Canada. If your team genuinely needs a long-term +387 line, email [email protected]; whether one is possible depends on local rules, and there is no promise it can be arranged.

Billing for the gateway is one prepaid USD wallet with no monthly fee and no plan to choose. Funds can be added with a card or USDT/USDC stablecoins; a PDF invoice for each deposit lands in your inbox. For integration work, a development account can be switched to sandbox on request, returning simulated numbers and codes so your pipeline runs without touching wallet funds. Current rates live on the pricing page, and you can create an account with an email code or Google sign-in.

Frequently asked questions

Can I test my app's Bosnian sign-up flow without a local SIM?

Yes. Order a +387 number for your service through the OTP Gateway, enter it in your app, and read the code in the dashboard or from the API.

What country id does OTP Route use for Bosnia and Herzegovina?

The id is ba. Pass it as the country field when you create an activation and as the country query parameter when you check prices.

Do I pay if the +387 code never arrives?

No. If nothing arrives inside the 20-minute window, or you cancel, the full amount goes back to your wallet automatically.

Should I keep the leading zero when saving a Bosnian mobile number?

No. Save numbers in E.164, which means +387 followed by the number without its domestic trunk zero.

Is a +387 number for testing suitable for an account we must log into again next month?

Not really, because each gateway number covers one verification. For repeat logins, a Dedicated Number in the US or Canada is the self-serve option; for a Bosnian long-term line, ask the team by email.

Can I run Bosnian OTP tests in CI without spending money?

Yes, by asking for sandbox mode on a development account. It returns simulated numbers and codes so the whole flow, including webhooks, can be exercised for free.

Are there rules on how these numbers can be used?

Yes. Follow each service's terms, use numbers only for your own legitimate products and accounts, and note that the OTP Route Acceptable Use Policy applies to every order.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.