A Pre-Flight Checklist for Receiving +372 Verification Codes in Estonia

What belongs on the checklist before the first +372 order?

Most failed test runs trace back to something missing before the number was ever requested. Tick these off first:

• An API key created in the Developer console. Each key carries the or_live_ prefix and travels as a Bearer token; with room for 10 per account, the CI runner deserves a key of its own.
• A webhook endpoint with its secret stored server-side, if you would rather be called than poll. Five endpoints per account are allowed.
• The right ids. Estonia is ee in every request, and the service id comes from GET /api/v1/services.
• A live price check. Call GET /api/v1/prices?country=ee&service=<id> so the job knows the cost before it commits wallet funds.
• Sandbox, if you are still wiring things up. On request a development account can switch to sandbox mode, which returns simulated numbers and codes end to end without touching your balance.
• A rate budget. The API accepts 300 requests per minute per account, which is plenty unless a test suite polls carelessly.

The OTP API integration guide covers each of these in more depth.

How do I run an Estonia OTP API request from start to finish?

With the checklist done, the call sequence is short:

1. POST /api/v1/activations with the body {"service": "<id>", "country": "ee"}. The response carries an activation id and the +372 number to type into the sign-up or login form under test.
2. Trigger the verification SMS from the app you are testing.
3. Wait for the code. Either your endpoint receives activation.sms_received, or you call GET /api/v1/activations/{id} on a sensible interval.
4. Submit the code in the app and record the result against the activation id.
5. If the test path changes and the number is no longer needed, call POST /api/v1/activations/{id}/cancel so the hold is released straight away.

For webhook deliveries, read the X-OTPRoute-Signature header (t=<unix>,v1=<hex>), compute HMAC-SHA256 over <t>.<raw body> with the endpoint secret, compare in constant time, and drop anything with an old timestamp. Securing OTP webhooks with HMAC walks through a reference handler. Make writes idempotent on the activation id, because a retry can deliver the same event twice.

Which services can send codes to an Estonian verification number?

The live snapshot for Estonia lists more than 1,700 services. Popular routes include WhatsApp, Telegram, Google (Gmail & YouTube), Facebook, Instagram, LinkedIn, Microsoft & Outlook, Amazon, Discord, Signal, Uber, Airbnb and ChatGPT (OpenAI).

Inventory moves through the day, so a route that answered this morning might be thin by evening. Treat GET /api/v1/countries and the price endpoint as the source of truth rather than hard-coding a list into your test fixtures.

How should +372 numbers be stored and validated?

Estonia is one of the simpler numbering plans to handle, which is exactly why lazy validators break on it. There is no trunk prefix to strip: a number written domestically is the same digits you append after +372. Mobile numbers usually begin with 5 and are seven or eight digits long, so a regex that insists on a fixed national length will reject valid inputs.

Practical rules for your forms and database:

• Store the full E.164 string, such as +3725xxxxxxx, and keep the raw user input separately if you need it for support.
• Never prepend a zero; there is nothing to remove or add.
• Test both the seven-digit and eight-digit mobile lengths in your input masks.

Verification texts aimed at Estonian users typically arrive in Estonian, though many apps follow the account or device language, and Russian or English templates are common too. If your product ships an Estonian locale, check that letters such as õ, ä, ö and ü survive the trip from template to handset.

Why do teams test sign-up flows on Estonian numbers?

Estonia punches above its size for software teams. Its digital-government reputation and the e-Residency programme mean many founders and remote companies have a link to the country even when staff live elsewhere, and products targeting the Baltic and Nordic region often launch there first.

Typical reasons a QA lead asks for a +372 number for testing:

• Confirming that country pickers, phone masks and SMS templates behave for an EU market with a short numbering plan.
• Localization checks on Estonian copy before a regional release.
• Reproducing a support ticket from an Estonian customer whose code never arrived.

See QA testing for how teams fold these checks into a release cycle.

What should I check when the code never shows up?

Work through the problem in order rather than ordering number after number:

1. Let the window run. The activation stays open for 20 minutes, and some services queue their texts.
2. Confirm the service takes virtual numbers. Some services reject them by policy; that is the reason the refund exists.
3. Look at the final status. An activation.expired event, or an expired state from the GET call, means no SMS arrived and the money is already back in the wallet.
4. Retry with patience. Try again a little later, or try another route for the same service, instead of re-ordering in a tight loop.
5. Check your own trigger. A test that never actually requested the SMS looks identical to a missing code.

Our write-up on reducing failed OTP deliveries lists further causes worth ruling out.

Can I keep an Estonian line long-term, and how does billing work?

There is no self-serve long-term Estonian number. Dedicated Numbers are a US and Canada product from $1.95/month; for Estonia, email [email protected] if your team needs a persistent line, and the team will tell you what local rules allow, without any promise of availability.

Billing for OTP routing runs through one prepaid USD wallet with no monthly fee and no plan to choose. Top up by card or with USDT or USDC, and each top-up produces a PDF invoice by email. Current rates are on the pricing page, and the endpoint reference lives in the docs.

Frequently asked questions

Can I test my app's Estonian sign-up flow without a local SIM?

Yes. Order a +372 number through the OTP Gateway, use it in your sign-up form and read the code from the dashboard, a webhook or the activation endpoint.

What is the country id for Estonia in the OTP Route API?

Use ee as the country value in activation and price requests.

Do Estonian phone numbers have a trunk prefix I need to remove?

No. Estonia has no trunk prefix, so the domestic digits follow +372 unchanged.

Am I charged when no Estonian code arrives?

No. If nothing arrives within the 20-minute window, or you cancel first, the full amount goes back to your wallet automatically.

Can a non-developer order an Estonia verification number?

Yes. In the dashboard, choose Estonia and the service, confirm the shown price, copy the number into the app and wait for the code to appear on the same screen.

Can the Estonian integration be rehearsed before real funds are spent?

Ask support to switch your development account to sandbox, which returns simulated numbers and codes so the whole flow can run without wallet funds.

What rules apply to how I use these numbers?

Follow each service's terms and OTP Route's Acceptable Use Policy; the numbers are for testing and operating your own legitimate products and accounts.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.