irnoti / php-sms-panel-api

dev-main 2026-10-10 14:07 UTC

Requires

• php: ^8.1
• ext-curl: *
• ext-json: *

Requires (Dev)

• phpunit/phpunit: ^10.5|^11.0

MIT

• irnoti

• sms
• sdk
• otp
• API-Client
• iran
• sms-api
• irnoti

Published on Packagist.org on 2026-10-11 07:26 UTC

README

Framework-agnostic PHP SDK (ext-curl). On Laravel use irnoti/laravel-sms-panel-api, which adds the service provider, facade and config.

composer require irnoti/php-sms-panel-api

$irnoti = new Irnoti\Sdk\IrnotiClient(getenv('IRNOTI_API_KEY'));   // baseUrl, timeout, retries, transport are optional

try {
    $irnoti->sms()->send(lineId: 1, to: '09121234567', text: 'Hi', idempotencyKey: 'k1');
    $irnoti->sms()->pattern(code: 'k3f9a2', to: '09121234567', params: ['code' => '4821']);
    $irnoti->services()->smart(['09121234567'], 'Hello');
} catch (Irnoti\Sdk\Exceptions\IrnotiApiException $e) {
    $e->isInsufficientBalance();
}

$event = Irnoti\Sdk\Support\Webhook::parse(file_get_contents('php://input'), $_SERVER['HTTP_X_IRNOTI_SIGNATURE'] ?? '', $secret);

Pass a transport callable to plug in Guzzle or a PSR-18 client or to fake HTTP in tests.

Behaviour shared by all irnoti SDKs

• Auth: Authorization: Bearer irn_live_…. Use an irn_test_… key with lineId: "sandbox" to try sends for free. Keys carry scopes (sms.send, sms.read, wallet.read, phonebook.read|write, bot.send|read, verify.send|read); a missing scope is a 403.
• Money is integer Rial returned as a string ("1960") — never parse it into a float.
• Idempotency: every send takes an idempotency key; retrying with the same key never sends twice (replayed: true). Automatic retries apply only to GETs and sends that carry a key.
• Errors: one error type carrying status, the API's machine code (insufficient_balance, invalid_recipients, no_price, … — empty for plain 401/403/404) and details, with helpers such as isInsufficientBalance / isRateLimited / isUnauthenticated.
• Limits: send 600 req/min, pattern 1200 req/min per IP (429 when exceeded).
• Webhooks: verify the raw body against X-Irnoti-Signature: t=<unix>,v1=<hex> (HMAC-SHA256 of "<t>.<body>" with your whsec_… key); signatures older than 5 minutes are rejected.
• Bot creation/configuration and verify settings are panel-only and not exposed.

Sibling SDKs: Laravel · Node.js · Python · Go · PHP. API reference: irnoti.com/docs.

MIT licensed.