SMS Alert
MESSAGING · MESSAGING
SMS and one-time passwords sent to contacts and groups from that account.
Connect SMS Alert with Fabriq Developer
Your user pastes their SMS Alert credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting SMS Alert in practice
SMS Alert passes the API key as a query parameter on GET URLs, so the credential lands in proxy logs, browser history and anything that records a URL. Every send also has to name a `sender` ID and, for OTP flows, a registered `template`, and a missing one comes back as "no senderid available for your account" or "no template available for your account" rather than a validation error.
Scopes that draw scrutiny
apikey query parameterOne account-wide key, passed in the URL as `?apikey=…`. The same key reaches /user.json (profile), /users/add.json (register a new account) and /changepwd.json (change a password), so it is not a send-only credential.
Worth knowing
- Usage exhaustion is a 402, not a 429: "Payment Required – Action unavailable on your plan or usage limits exceeded". A 429 exists separately for "calling our APIs more frequently than we allow", with no published figure.
- Endpoints carry a .json suffix (push.json, grouppush.json, mverify.json, templatelist.json), and several documented examples still use http:// rather than https://.
- Bulk sends go through a different endpoint and take a `route` (for example transactional) rather than being inferred from the message.
- OTP behaviour is expressed inside the template string itself, as in `[otp length="6" retry="2"]`, so retry policy is content rather than a parameter.
Checked against SMS Alert developers API (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put SMS Alert behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.