A timeout is not a failure
Sending is accepted asynchronously and there is no de-duplication key. Retrying a request you are unsure about sends a second message and bills for it.
Read the guide →Two-factor authentication codes, sent in time
A 2FA message is triggered by a login attempt, is time-critical, and — when it arrives unexpectedly — is the earliest signal your customer gets that someone else has their password. Send it fast, word it as a warning, and keep the record.
What a good code message contains
- The code, formatted so it is easy to transcribe
- A plain statement of what triggered it
- An explicit “if this was not you” instruction
- Nothing else — no links to anything other than your own domain
The unexpected code is doing its job
If a message arrives that the customer did not request, it is the earliest signal available that someone else has their password. Wording it as a warning rather than a nuisance is what turns the message into a security control instead of a support ticket.
Absorb the login spike instead of dropping it
Login traffic is spiky and unpredictable. On the SMS channel, pacing is applied per sender number and routing can move traffic to another connected account, so a spike is absorbed as a delay rather than a wave of failures.
- Per-number pacing instead of one shared quota
- Failover across connected SMS accounts
- Every send logged, so an incident can be reconstructed
Questions this usually raises
- Can a 2FA code be suppressed by an opt-out?
- No. Suppression applies to promotional traffic; a login challenge is transactional and is not filtered by the same rule.
- Should 2FA and marketing go out from the same number?
- That is a sender-identity decision. Keeping security traffic on a number that only sends security traffic makes an unexpected message easier for the customer to interpret.
- What records are kept?
- Each send is logged with its status, and delivery receipts are recorded wherever the provider reports them, so an incident review works from a record rather than a recollection.
Keep reading
Which rate limit you just hit
There are two throttles in front of a send: the one your plan sets, and a much higher one at the network edge. Both answer with the same status code, so the message text is what tells them apart.
Read the guide →One-time passwords
Your login depends on a code landing before the session expires. Connect the accounts you already pay for and the platform paces each code to the number it leaves from — so a burst of logins drains at the speed your numbers allow instead of queueing behind one shared quota.
Open →Order confirmations
The confirmation is the message your customer keeps — forwarded, screenshotted, quoted back to support. Send it the moment the order lands, on a channel they actually read, and let the log answer for it later.
Open →Shipping and delivery updates
Dispatch notices, tracking updates and delivery windows go out when the state actually changes, not on a timer. On the SMS channel the platform spreads a dispatch batch to the limit your provider applies per number, so a whole route does not stall halfway through.
Open →Appointment reminders
A reminder earns its place by arriving early enough to change a plan and saying only what the person needs to act on: when, where, and how to change it. Send a confirmation at booking and a timed reminder before, on the number they booked with.
Open →Payment reminders
The reminder that arrives before a due date is a service; the one that arrives after is a complaint notification. Send both, keep them transactional, and pace the due-date batch so it drains in a time you can plan around.
Open →Account security alerts
A security alert is not a notification — it is the account owner’s chance to interrupt something in progress. Speed and clarity are the whole job, and detail is a liability.
Open →Service and incident alerts
An incident alert arrives when something is already wrong — the worst possible moment to discover your send path is down too. Keep more than one connected account on that channel, and the notice about the outage is not its first casualty.
Open →Customer feedback requests
A feedback request is marketing in everything but name, so treat it like one: one question, sent once, to people who have not opted out. That is what keeps the answers worth reading.
Open →Scope. Whaleal Platform sends over the CPaaS or BSP accounts you already hold. Your contracts, your rates and your sender identities stay yours, and nothing in the middle reprices them. Routing and pacing run on the SMS channel while logging covers every channel; consent and content stay with you.