Verifying +350 numbers for teams that build or operate on the Rock

What problem are Gibraltar teams usually trying to solve?

Gibraltar punches well above its size in regulated online businesses: remote gaming operators, payment firms and financial services companies run large teams there. Those products have strict onboarding, and a compliance-minded QA lead wants proof that a customer with a +350 mobile can get through registration, step-up login and recovery.

The complication is the workforce itself. Many staff live across the border in Spain and carry Spanish SIMs, so finding a Gibraltar handset for every test run is awkward, and using anybody's private phone ties a business account to one person. A Gibraltar verification number from the OTP Gateway removes that dependency for each single code you need.

How are +350 numbers formatted, and what trips validators?

Gibraltar uses a closed eight-digit plan with no trunk prefix, so the digits a resident dials locally are the same digits that follow +350 internationally. Mobile numbers generally begin with 5, while fixed lines begin with 200.

That simplicity still catches people out:

• Store +350 plus eight digits, nothing else, and strip spaces before saving.
• Do not add or remove a leading 0; there is none to handle here, unlike in the United Kingdom or Spain.
• Avoid validators that expect nine digits because they were tuned for the Spanish market next door.
• Keep the country selector separate from the Spain entry; users cross between the two all day and may hold numbers in both.

English is the official language, yet Spanish is widely spoken, so apps may send the code in either language depending on the account or device settings. If your template is localised, test both versions.

Which services are reachable on the Gibraltar route?

The live list today covers WhatsApp, Telegram, Google (Gmail & YouTube), Facebook, Instagram, LinkedIn, X (Twitter), ChatGPT (OpenAI), Claude, Microsoft & Outlook, Amazon, Discord, Signal and Uber, among more than 1,200 services in total. Stock rotates through the day, which is why the API reports availability at the moment you ask rather than from a fixed catalogue.

If a particular service is missing for Gibraltar when you check, neighbouring routes such as Spain or the United Kingdom may suit a test that does not strictly need a +350 prefix.

How do we automate Gibraltar OTP capture through the API?

The Gibraltar OTP API is the same REST surface as every other country; only the id gi changes. Create a key with the or_live_ prefix in the Developer console, then:

1. List what is on offer with GET /api/v1/services and GET /api/v1/countries.
2. Price the pair with GET /api/v1/prices?country=gi&service=telegram.
3. Order it via POST /api/v1/activations, body {"service": "telegram", "country": "gi"}.
4. Receive activation.sms_received on a registered webhook, or read GET /api/v1/activations/{id} on a polling loop with sensible spacing.
5. Listen for activation.expired and activation.cancelled so your test runner can close the case cleanly.

Verify every delivery by recomputing the HMAC-SHA256 in X-OTPRoute-Signature over "<t>.<raw body>" with your endpoint secret and discarding old timestamps. Limits are 10 keys, 5 webhook endpoints and 300 requests per minute per account. Teams wiring this into pipelines can follow our piece on SMS OTP testing in CI.

What is the dashboard route for people who do not use the API?

Compliance analysts and account managers can receive a Gibraltar SMS OTP from the browser. Sign in, add funds, pick the service and Gibraltar in the OTP Gateway, check the displayed price and confirm. Enter the number in the target app and watch the order: the code lands there once the service sends it.

The number stays reserved for 20 minutes and handles one code. You pay only if that code arrives; an empty window or a manual cancellation returns the money to your wallet.

Why might a +350 code fail to show up?

Small markets have fewer carrier paths, and some services screen virtual ranges. When nothing appears:

• Leave the activation open until the window closes rather than cancelling after a minute.
• Wait before retrying, then try later or with a different service route; repeated instant re-orders tend to make filtering worse.
• Check whether the app openly rejects virtual numbers; if it does, the refund covers the attempt and you should test another way.
• Make sure your front end submitted all eight digits after the country code.

Our write-up on country routing for OTP explains how route choice affects results.

Can we hold a Gibraltar number long term, and how is payment handled?

There is no self-serve long-term Gibraltar number. Dedicated Numbers, from $1.95/month, are sold only for the United States and Canada. Should your operations team need a lasting +350 line, email [email protected]; the answer depends on local regulation and may be no.

Everything else runs from a prepaid USD wallet: no subscription, top-ups by card or USDT/USDC, and a PDF invoice by email for each payment, which keeps finance teams in regulated firms happy. Ask for sandbox mode on a development account to run simulated numbers and codes through your integration at no cost. Current rates sit on the pricing page.

Frequently asked questions

Can I receive a Gibraltar verification code without being in Gibraltar?

Yes. The OTP Gateway issues a +350 number you can use from anywhere, and the code appears in your dashboard or on your webhook.

Do Gibraltar numbers have a trunk prefix like the UK's leading 0?

No. Gibraltar uses eight-digit numbers without a trunk prefix, so the national and international digits are identical after +350.

Which API country id do I use for Gibraltar?

Pass gi as the country value in price lookups and in POST /api/v1/activations.

What does a +350 number for testing cost?

From $0.20 per code, with the exact rate depending on the service; the API and dashboard both show it before you buy.

What happens if my app's code never reaches the Gibraltar number?

After 20 minutes without an SMS the activation expires and the full amount returns to your wallet automatically.

Will the code arrive in English or Spanish?

That depends on the sending service; many use the account or device language, so localised flows are worth testing in both.

Can I use these numbers for any kind of account?

Only for legitimate testing and your own business accounts. Follow each service's terms and OTP Route's Acceptable Use Policy.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.