01 · TEST KEYS
Isolated kamba_test_ keys
Separate credentials that never touch your live SMS balance or real mobile carriers.
Sandbox + OTP v2 Lifecycle
KambaSMS / Sandbox
Test the full lifecycle before sending a real SMS.
Validate both deterministic scenarios and the stateful Sandbox OTP v2 engine (with otp_id, 5-minute expiry, 5 attempts and single-use verification) at zero cost.
POST /sandbox/v2/otp/send0 CRÉDITOS · STATEFUL V2
X-API-Key: kamba_test_...
Idempotency-Key: test-otp-001
{
"phone": "+244923000000"
}
→ 200 OK
{
"otp_id": "d4e8...91c2",
"test_code": "482916",
"expires_in": 300,
"max_attempts": 5
}02 · ZERO COST
0 Kz per simulation
Validate payloads, error handling, idempotency and webhooks before buying credits.
03 · SANDBOX OTP V2
Full stateful OTP lifecycle
Real 5-minute expiry, max 5 attempts, single-use consumption and HMAC domain isolation.
04 · LEGACY VS V2
Deterministic & stateful modes
Legacy simulation accepts 123456 repeatedly without real expiry; Sandbox OTP v2 validates real expiry and single use.
01Two testing modes
Quick deterministic checks or full OTP v2 state machine.
MODE 01 · STATELESS
Deterministic Simulator (/sandbox/otp)
Ideal for initial connectivity checks. Accepts fixed code 123456 repeatedly and simulates expiry with 999999 without storing state.
POST /otp/send (kamba_test_) → code: 123456MODE 02 · STATEFUL V2
Lifecycle Sandbox OTP v2 (/sandbox/v2/otp/*)
Mirrors production security: requires otp_id on verify, enforces 5-minute expiry, blocks after 5 wrong attempts, invalidates after first use and tests SQL quotas (3/h per number).
POST /sandbox/v2/otp/send → POST /sandbox/v2/otp/verify