The technology behind SMSRay

Fast pages, served from the edge

smsray.com, the customer portal and the admin are web apps built with Next.js and React, served from the Vercel edge network.

• Next.js
• React
• Vercel edge
• @lacspace/components

• Interfaces built with the Lacspace component kit (@lacspace/components and friends), published openly on npm
• Light and dark themes, responsive from small phones up
• Server-rendered pages, so content loads without waiting on scripts

A small, predictable REST API

The SMSRay API is a Node.js service running on AWS in the ap-south-1 region.

• Node.js
• AWS ap-south-1
• REST + JSON

• One versioned base URL and one auth header (x-api-key)
• One error shape everywhere: error, code and optional details
• A per-client send rate limit (default 20 per second) that keeps traffic smooth

Stored carefully, kept to what's needed

Workspaces, messages, templates and logs live in MongoDB.

• MongoDB

• OTP codes stored only as SHA-256 hashes, hidden in logs
• API keys and session tokens stored as hashes, never readable again
• Idempotency records kept for 24 hours so retries never double-send

Secrets hashed, traffic encrypted

Security controls are built into the platform, not bolted on per customer.

• Let's Encrypt TLS
• HMAC-SHA256

• HTTPS everywhere, with TLS certificates from Let's Encrypt
• HMAC-signed webhooks, checked within ±300 s, with secret rotation
• IP allowlists and scoped API keys
• Audit logs of every dashboard change: who, when and from where
• Template approval, so every custom message is reviewed before it can be sent

Built so a retry is always safe

Networks blip and servers restart. The platform is designed so nothing gets lost or sent twice.

• Webhooks retried up to 8 times with backoff (10 s, 30 s, 2 min, 10 min, 30 min, 1 h, 3 h, 6 h)
• Idempotency keys on every POST: send the same request twice, get one message
• Automatic retries on delivery, with failed messages credited back
• Rate limits that protect every workspace from a noisy neighbour

Test first, then go live

Everything a developer needs to integrate in an afternoon, and to trust it in production.

• Test mode, so you can build your integration without sending real SMS
• Docs with copy-paste cURL, Node.js, Python and PHP samples
• A built-in OTP API that works on day one with our approved template
• Free SMS length and cost calculator, plus llms.txt for AI assistants