Collecting Indonesian +62 OTP codes programmatically

Which endpoints does an Indonesia OTP API integration call?

Everything runs against https://otproute.com/api/v1 with a Bearer key carrying the or_live_ prefix. Create one in the Developer console; an account can hold up to 10 keys, which makes it easy to separate a CI runner from a staging box.

1. Fetch GET /api/v1/services and GET /api/v1/countries and cache both lists. Indonesia appears with the id id.
2. Ask GET /api/v1/prices?country=id&service=<id> for the current price and availability of the service you are about to test. Inventory moves during the day, so query it per run rather than hardcoding.
3. Create the order with POST /api/v1/activations and a body like {"service": "tokopedia", "country": "id"}. You get back an activation id plus a +62 number.
4. Type or inject that number into the phone field of your own app or test account.
5. Read the result through a webhook, or poll GET /api/v1/activations/{id}. Abort cleanly with POST /api/v1/activations/{id}/cancel when a test fails before the SMS step.

A quick GET /api/v1/balance before the suite starts lets a run fail early instead of halfway through. Polling at a sensible interval fits easily inside the 300-requests-per-minute ceiling. Full schemas live in the API docs.

How do I process +62 codes with a signed webhook?

Polling is fine for a single developer; parallel jobs are calmer with push delivery. Register up to 5 endpoints per account and subscribe to activation.sms_received, activation.expired and activation.cancelled.

Every request includes an X-OTPRoute-Signature header in the form t=<unix>,v1=<hex>. Rebuild the signed string as <t>.<raw body>, compute HMAC-SHA256 with the endpoint secret, and compare it to v1 in constant time. Hash the raw bytes before any JSON parsing, and drop requests whose timestamp is too old so a captured payload cannot be replayed.

Treat events as keyed on the activation id and make the handler idempotent: a retried delivery should simply find the code already stored. Our write-up on HMAC webhook security walks through the checks.

Which services can receive Indonesian SMS OTP on OTP Route?

The live snapshot for Indonesia covers more than 3,000 services. Popular routes include WhatsApp, Tokopedia, Shopee, Lazada, Telegram, Google (Gmail & YouTube), Facebook, Instagram, TikTok, LINE, Discord, Microsoft & Outlook and ChatGPT (OpenAI).

For colleagues who never touch the API, the dashboard does the same job: sign in, choose the service, choose Indonesia, check the price shown, and order. The +62 number appears on screen and the code is displayed next to it once the SMS comes in. Cancel from the same view if the test is called off.

How should a +62 number be stored and normalized?

Indonesia uses a trunk prefix of 0, so people write mobile numbers domestically as 08 followed by the rest of the digits. In E.164 the 0 disappears: a number written locally as 0812... becomes +62812.... Store the E.164 form, normalize anything a user types by stripping spaces, dashes and the leading 0, and let a maintained phone-number library judge validity, because Indonesian subscriber numbers do not all share one length.

SMS templates sent to Indonesian numbers are frequently in Bahasa Indonesia, though some services send English. Extract the code with a digit pattern instead of matching words like "kode" or "code", and your parser will not care which language the template uses.

Why do product teams test sign-up flows in Indonesia?

Indonesia is one of the most populous countries in the world and its internet use is heavily mobile-first, so phone-number verification sits at the front of many onboarding flows. Teams expanding into Southeast Asia want to see their own Indonesian sign-up and login screens behave correctly with a real +62 number, check that Bahasa Indonesia copy renders without truncation, and confirm that their fraud rules do not block legitimate local users.

Regional operations and marketplace teams also use the route to verify business accounts they manage for Indonesian storefronts. The QA testing page covers how to fold this into a regression plan.

What if the Indonesian code never shows up?

Delivery time depends on the service and the route, so give the activation room before deciding it failed. When no SMS arrives:

• Let the 20-minute window run out, or cancel; either way the full amount returns to your wallet automatically.
• Order again a little later, or try another service route if your test allows it.
• Confirm the target service accepts virtual numbers for this action. Some do not, which is exactly why the refund rule exists.
• Avoid re-ordering in a tight loop. Back off between attempts so a CI job does not burn through retries in seconds.

More diagnostic ideas are in reducing failed OTP deliveries.

Is there a dedicated +62 number, and how is it billed?

No. A self-serve long-term Indonesian line is not offered. Dedicated Numbers are a United States and Canada product, from $1.95/month. If your team truly needs a lasting +62 line, email [email protected]; whether one can be arranged depends on local rules and is not promised.

Billing for the OTP Gateway uses one prepaid USD wallet with no monthly fee and no plan to choose. Fund the wallet with a card or with USDT/USDC stablecoins; each top-up triggers an emailed PDF invoice for your finance records. Development accounts can request sandbox mode, which returns simulated numbers and codes for end-to-end integration tests without spending funds. See pricing or create an account.

Frequently asked questions

Can I test my app's Indonesian sign-up flow without a local SIM?

Yes. Order a +62 number from the OTP Gateway for the relevant service, enter it in your app, and read the code in the dashboard or through the API.

What country id does the OTP Route API use for Indonesia?

Indonesia is id, so a price lookup reads GET /api/v1/prices?country=id&service=<id>.

Do I pay if the Indonesian SMS never arrives?

No. If nothing comes in during the 20-minute window, or you cancel, the full charge goes back to your wallet automatically.

Should I keep the leading 0 when saving an Indonesian mobile number?

Keep it only for display in local format. Store +62 followed by the national number without the 0, which is the E.164 form.

Will Indonesian verification texts be in English?

Not always. Many arrive in Bahasa Indonesia, so parse the numeric code rather than relying on surrounding words.

Are Indonesian numbers allowed for any purpose?

Only legitimate use: testing and operating your own products and accounts within each service's terms. The OTP Route Acceptable Use Policy applies to every order.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.