Send OTP codes and notifications straight from your system

# Credentials come from the environment, never from the command line
# (a literal password would land in your shell history).
curl --get "https://sms.masrbokra.com/sendsms.php" \
  --data-urlencode "user=$MASRBOKRA_SMS_USER" \
  --data-urlencode "password=$MASRBOKRA_SMS_PASSWORD" \
  --data-urlencode "numbers=201001234567" \
  --data-urlencode "sender=YOUR_SENDER" \
  --data-urlencode "message=Your order has shipped." \
  --data-urlencode "lang=en" \
  --connect-timeout 10 \
  --max-time 20 \
  --no-retry-all-errors

# The reply is plain text: "1", or "1:201001234567", or an error string.

<?php
// Server-side only. Never call this endpoint from browser JavaScript.
$params = [
    'user'     => getenv('MASRBOKRA_SMS_USER'),
    'password' => getenv('MASRBOKRA_SMS_PASSWORD'),
    'numbers'  => '201001234567',
    'sender'   => getenv('MASRBOKRA_SMS_SENDER'),
    'message'  => 'Your order has shipped.',
    'lang'     => 'en',
];

// http_build_query URL-encodes every value, including the Arabic ones.
$url = 'https://sms.masrbokra.com/sendsms.php?' . http_build_query($params);

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 10,
    CURLOPT_TIMEOUT        => 20,
]);
$body = curl_exec($ch);
curl_close($ch);

$reply = trim((string) $body);

// Strict match. startsWith('1') would also accept "10" and "11:...".
$accepted = $reply === '1'
    || preg_match('/^1:[1-9]\d{7,14}(,[1-9]\d{7,14})*$/', $reply) === 1;

// Log the reply, never $url — it contains the password and the message text.
error_log('MasrBokra reply: ' . $reply);

// Acceptance is not delivery. Do not resend automatically on a timeout:
// the gateway may already have accepted the request.

// Server-side only (an API route, a worker, a cron job) — never the browser.
const ACCEPTED = /^1:[1-9]\d{7,14}(?:,[1-9]\d{7,14})*$/;

export async function sendSms({ numbers, message, lang = 'en' }) {
  // URLSearchParams encodes every value for us.
  const params = new URLSearchParams({
    user: process.env.MASRBOKRA_SMS_USER,
    password: process.env.MASRBOKRA_SMS_PASSWORD,
    numbers,
    sender: process.env.MASRBOKRA_SMS_SENDER,
    message,
    lang,
  });

  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), 20_000);

  let reply;
  try {
    const res = await fetch(
      `https://sms.masrbokra.com/sendsms.php?${params}`,
      { signal: controller.signal },
    );
    reply = (await res.text()).trim();
  } finally {
    clearTimeout(timer);
  }

  // Log the reply only. The URL carries the password and the message body.
  console.log('MasrBokra reply:', reply);

  // Accepted by the gateway — which is not the same as delivered to a handset.
  return { accepted: reply === '1' || ACCEPTED.test(reply), reply };
}

// On AbortError, surface it for a human to check the balance or the account
// log. Do not retry on a schedule: the send may already have gone through.

import os
import re
import requests

ACCEPTED = re.compile(r"^1:[1-9]\d{7,14}(?:,[1-9]\d{7,14})*$")

def send_sms(numbers: str, message: str, lang: str = "en") -> tuple[bool, str]:
    """Send through the MasrBokra gateway. Server-side use only."""
    params = {
        "user": os.environ["MASRBOKRA_SMS_USER"],
        "password": os.environ["MASRBOKRA_SMS_PASSWORD"],
        "numbers": numbers,
        "sender": os.environ["MASRBOKRA_SMS_SENDER"],
        "message": message,
        "lang": lang,
    }

    # requests URL-encodes params, including UTF-8 Arabic text.
    response = requests.get(
        "https://sms.masrbokra.com/sendsms.php",
        params=params,
        timeout=(10, 20),  # connect, read
    )
    reply = response.text.strip()

    # Log the reply, never response.url — it contains the password.
    print("MasrBokra reply:", reply)

    # Strict match, not reply.startswith("1").
    accepted = reply == "1" or bool(ACCEPTED.match(reply))

    # Accepted != delivered. Let a requests.Timeout raise rather than retrying
    # in a loop, because the gateway may already have taken the request.
    return accepted, reply