Rate limits
Two different things are bounded here, and confusing them wastes time: how fast you may call the API, and how much may be spent in an hour.
Request rate
Exceeding it returns 429 with too_many_attempts and aRetry-After header in seconds. Wait that long. Retrying in a tight loop simply extends the window.
Sign-in is throttled separately and more tightly, on email and IP together — on email alone, anybody could lock you out of your own account by failing on purpose.
The hourly spend ceiling
Each account has a ceiling on how much can be spent in a rolling 60 minutes. Cross it and sends are refused with INSUFFICIENT_FUNDS until the window rolls forward.
It is published on your balance, so you can see it before you hit it rather than discovering it as an unexplained rejection. Ask us and we will raise it; it exists to bound a bad night, not to get in your way.
This is a hard stop, not an alert. An alert at 3am is a five-figure invoice with a notification attached.
Why these controls exist
SMS pumping: somebody signs up, integrates your OTP endpoint, and fires verification messages at number ranges in countries where they have a revenue share with the terminating operator. You are billed wholesale — often ten to fifty times a UK message — and they take a cut.
The traffic looks entirely legitimate. Real API calls, valid E.164 destinations, successful deliveries. By the time the carrier invoice arrives it is five figures. Nothing here tries to detect fraud in the abstract; each control bounds a specific quantity.
Country allowlist
New accounts reach the UK, Guernsey, Jersey and the Isle of Man. Everything else is opened on request. This is the strongest single control, because almost all pumping targets destinations a normal business never sends to.
New-country burst
The first ten messages to a country you have never sent to are allowed; beyond that, in the same hour, they are held. A legitimate expansion into a new market is not ten thousand messages in the first ten minutes.
High-risk ranges
A short, specific list of prefixes that are overwhelmingly pumping targets rather than customers. Deliberately short — a broad list blocks real business, and the country allowlist already does the heavy lifting.
Campaign throughput
Campaigns are throttled per minute rather than fired at once. Carriers rate limit at their end, and a burst gets you filtered rather than delivered — the throttle is there to get your messages through, not to slow you down.