PHP ile SMS Kodu Alma

php -v                          # PHP 7.4 or newer (8.x recommended)
php -m | grep -i curl           # the curl extension must be listed
export TURONAY_API_KEY="paste-your-api-key-here"

<?php
$url = 'https://turonay.com/stubs/handler_api.php?' . http_build_query([
    'api_key' => getenv('TURONAY_API_KEY'),
    'action'  => 'getBalance',
]);

$ch = curl_init($url);
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 20]);
$text = trim((string) curl_exec($ch));   // plain text, not JSON: "ACCESS_BALANCE:125.4000"

if (strpos($text, 'ACCESS_BALANCE:') === 0) {
    echo 'Balance (TRY): ', substr($text, strlen('ACCESS_BALANCE:')), PHP_EOL;
} else {
    echo 'Error: ', $text, PHP_EOL;       // e.g. BAD_KEY
}

<?php
declare(strict_types=1);

// sms_flow.php - buy a number, wait for the SMS code, finish or cancel.  Needs ext-curl.
const API = 'https://turonay.com/stubs/handler_api.php';

/** The API answered with a plain-text error code (NO_BALANCE, NO_NUMBERS, ...). */
class ApiError extends RuntimeException {}
/** Network trouble, HTTP 429 or 5xx, NO_CONNECTION: safe to retry later. */
class Transient extends ApiError {}
class CodeTimeout extends RuntimeException {}

function apiCall(string $action, array $params = []): string
{
    $key = (string) getenv('TURONAY_API_KEY');
    $params = array_filter($params, static function ($v) { return $v !== null; });
    $query = ['api_key' => $key, 'action' => $action] + $params;

    $ch = curl_init(API . '?' . http_build_query($query));
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 10,
        CURLOPT_TIMEOUT        => 20,
    ]);
    $body = curl_exec($ch);
    $http = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    if ($body === false || $http !== 200) {
        throw new Transient('HTTP ' . $http);        // never print the URL: it holds your api_key
    }
    $text = trim((string) $body);                    // always trim: bodies are plain text
    if ($text === 'NO_CONNECTION') {
        throw new Transient($text);
    }
    return $text;
}

function getBalance(): string
{
    $text = apiCall('getBalance');
    if (strpos($text, 'ACCESS_BALANCE:') !== 0) {
        throw new ApiError($text);
    }
    return substr($text, strlen('ACCESS_BALANCE:'));
}

/** @return array [activationId, phone]. The price is only RESERVED here, not charged. */
function getNumber(string $service, string $country, ?float $maxPrice = null): array
{
    $text = apiCall('getNumber', [
        'service'  => $service,
        'country'  => $country,
        'maxPrice' => $maxPrice === null ? null : number_format($maxPrice, 2, '.', ''),
    ]);
    $parts = explode(':', $text);
    if ($parts[0] === 'ACCESS_NUMBER' && count($parts) >= 3 && $parts[1] !== '' && $parts[2] !== '') {
        return [$parts[1], $parts[2]];
    }
    throw new ApiError($text);   // NO_BALANCE, NO_NUMBERS, BAD_SERVICE, WRONG_MAX_PRICE:<price> ...
}

/** @return array [state, code] where state is 'wait', 'ok' or 'cancel'. */
function getStatus(string $id): array
{
    $text = apiCall('getStatus', ['id' => $id]);
    if (strpos($text, 'STATUS_OK:') === 0) {
        return ['ok', substr($text, strlen('STATUS_OK:'))];
    }
    if ($text === 'STATUS_CANCEL') {
        return ['cancel', null];
    }
    if ($text === 'STATUS_WAIT_CODE' || $text === 'STATUS_WAIT_RESEND' || strpos($text, 'STATUS_WAIT_RETRY:') === 0) {
        return ['wait', null];   // WAIT_RETRY carries the OLD code: still waiting for the new one
    }
    throw new ApiError($text);   // NO_ACTIVATION, BAD_KEY ...
}

function setStatus(string $id, int $status): string
{
    return apiCall('setStatus', ['id' => $id, 'status' => $status]);
}

function requestAnotherSms(string $id): string { return setStatus($id, 3); }  // free, ACCESS_RETRY_GET
function finish(string $id): string { return setStatus($id, 6); }              // ACCESS_ACTIVATION, only after a code
function cancel(string $id): string { return setStatus($id, 8); }              // ACCESS_CANCEL / EARLY_CANCEL_DENIED

/** Poll every $interval seconds for at most $timeout seconds (20 minutes). */
function waitForCode(string $id, int $timeout = 1200, int $interval = 5): string
{
    $deadline = microtime(true) + $timeout;
    $delay = $interval;
    while (microtime(true) < $deadline) {
        try {
            [$state, $code] = getStatus($id);
            $delay = $interval;
            if ($state === 'ok') {
                return (string) $code;
            }
            if ($state === 'cancel') {
                throw new ApiError('STATUS_CANCEL');
            }
        } catch (Transient $e) {
            $delay = min($delay * 2, 60);            // back off on HTTP 429 / network trouble
        }
        $left = $deadline - microtime(true);
        if ($left <= 0) {
            break;
        }
        sleep((int) max(1, min($delay, ceil($left))));
    }
    throw new CodeTimeout("no SMS within $timeout seconds");
}

function main(): int
{
    [$service, $country] = ['wa', '62'];             // WhatsApp, Turkey (see getPrices / getCountries)
    try {
        echo 'Balance (TRY): ', getBalance(), PHP_EOL;
        [$id, $phone] = getNumber($service, $country, 15.00);
    } catch (Transient $e) {
        echo 'Temporary problem, try again later: ', $e->getMessage(), PHP_EOL;
        return 1;
    } catch (ApiError $e) {
        $reason = $e->getMessage();
        if (strpos($reason, 'WRONG_MAX_PRICE') === 0) {
            $pos = strpos($reason, ':');
            echo 'Current price is above your limit: ', $pos === false ? '?' : substr($reason, $pos + 1), PHP_EOL;
        } elseif ($reason === 'NO_NUMBERS') {
            echo 'No numbers in stock right now, try again in a minute', PHP_EOL;
        } elseif ($reason === 'NO_BALANCE') {
            echo 'Not enough balance, top up first', PHP_EOL;
        } else {
            echo 'API error: ', $reason, PHP_EOL;
        }
        return 1;
    }

    echo "Use this number: $phone (activation $id)", PHP_EOL;
    try {
        $code = waitForCode($id);
    } catch (CodeTimeout $e) {
        $reply = cancel($id);                        // nothing is charged when no code arrived
        if ($reply !== 'EARLY_CANCEL_DENIED') {
            echo "Timed out, activation cancelled: $reply", PHP_EOL;
            return 1;
        }
        [, $code] = getStatus($id);                  // the code arrived in the last second
    } catch (ApiError $e) {                          // STATUS_CANCEL: the supplier cancelled, nothing charged
        echo 'Activation cancelled: ', $e->getMessage(), PHP_EOL;
        return 1;
    }

    echo "SMS code: $code", PHP_EOL;
    echo finish($id), PHP_EOL;                       // ACCESS_ACTIVATION
    return 0;
}

exit(main());

function getNumberV2(string $service, string $country, ?float $maxPrice = null): array
{
    $text = apiCall('getNumberV2', [
        'service'  => $service,
        'country'  => $country,
        'maxPrice' => $maxPrice === null ? null : number_format($maxPrice, 2, '.', ''),
    ]);
    $data = json_decode($text, true);
    if (!is_array($data)) {
        throw new ApiError($text);   // errors stay plain text, even in V2
    }
    return $data;                    // activationId, phoneNumber, activationCost, activationEndTime ...
}

/** @return array|string array with the SMS once it arrived, otherwise the plain-text status. */
function getStatusV2(string $id)
{
    $text = apiCall('getStatusV2', ['id' => $id]);
    $data = json_decode($text, true);
    if (!is_array($data)) {
        return $text;                // STATUS_WAIT_CODE, STATUS_WAIT_RETRY:<old>, STATUS_CANCEL ...
    }
    return ['code' => $data['sms']['code'] ?? null, 'text' => $data['sms']['text'] ?? null];
}

$order = getNumberV2('wa', '62', 15.00);
echo $order['activationId'], ' ', $order['phoneNumber'], ' ', $order['activationCost'],
     ' until ', $order['activationEndTime'], PHP_EOL;

// The first code has arrived and you need a second SMS on the same number (free).
$firstCode = waitForCode($id);
$reply = requestAnotherSms($id);               // setStatus status=3 -> ACCESS_RETRY_GET
if ($reply === 'ACCESS_RETRY_GET') {
    // While the new SMS is on its way getStatus answers STATUS_WAIT_RETRY:<first code>,
    // which waitForCode() treats as "still waiting".
    $secondCode = waitForCode($id);
    echo "First: $firstCode Second: $secondCode", PHP_EOL;
}
finish($id);                                   // close only after the LAST code

<?php
declare(strict_types=1);

// turonay_webhook.php - public HTTPS endpoint on YOUR server (port 443 or 8443).
$secret = (string) getenv('TURONAY_WEBHOOK_SECRET');      // whsec_... from your profile page

/** sha256=HMAC_SHA256(secret, timestamp . "." . raw body), 5 minute replay window. */
function verifyWebhookSignature(string $secret, string $timestamp, string $rawBody, string $signature, int $tolerance = 300): bool
{
    if (!preg_match('/^[0-9]{1,12}$/', $timestamp) || abs(time() - (int) $timestamp) > $tolerance) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, trim($signature));      // constant time
}

if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
    http_response_code(405);
    exit;
}
if ($secret === '') {
    http_response_code(500);
    exit;
}

$raw = (string) file_get_contents('php://input');         // the exact bytes, before json_decode
if (strlen($raw) > 65536 || !verifyWebhookSignature(
    $secret,
    $_SERVER['HTTP_X_TURONAY_TIMESTAMP'] ?? '',
    $raw,
    $_SERVER['HTTP_X_TURONAY_SIGNATURE'] ?? ''
)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
if (!is_array($event)) {
    http_response_code(400);
    exit;
}

// Retries repeat the same "id": store it (unique index) and skip events you already handled.
switch ($event['event'] ?? '') {
    case 'code_received':
        error_log("code {$event['code']} for activation {$event['activationId']} ({$event['phone']})");
        break;
    case 'cancelled':
        error_log("activation {$event['activationId']} cancelled, nothing charged");
        break;
}

http_response_code(200);                                  // answer 2xx within 5 seconds

<?php
// Before: define('SMS_API_URL', 'https://provider.example.com/stubs/handler_api.php');
define('SMS_API_URL', getenv('SMS_API_URL') ?: 'https://turonay.com/stubs/handler_api.php');
define('SMS_API_KEY', (string) getenv('SMS_API_KEY'));   // your Turonay API key

// Scripts and libraries that build their own query string keep working unchanged:
// SMS_API_URL . '?api_key=' . SMS_API_KEY . '&action=getBalance'