Send SMS to Indonesia
from $0.0120/msg

import requests, os

r = requests.post(
    "https://api.smsroute.cc/v1/messages",
    headers={"Authorization": f"Bearer {os.environ['SMSROUTE_API_KEY']}"},
    json={
        "to": "+6281234567890",
        "from": "ACMEID",
        "body": "Kode OTP Acme Anda: 384921. Berlaku 10 menit."
    }
)
print(r.json())

curl -X POST https://api.smsroute.cc/v1/messages \
  -H "Authorization: Bearer $SMSROUTE_API_KEY" \
  -d '{
    "to": "+6281234567890",
    "from": "ACMEID",
    "body": "Kode OTP Acme Anda: 384921. Berlaku 10 menit."
  }'

import fetch from "node-fetch";

const apiKey = process.env.SMSROUTE_API_KEY;

const res = await fetch("https://api.smsroute.cc/v1/sms/send", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${apiKey}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    to: "+625551234567",
    from: "smsroute",
    text: "Your verification code is 384921",
  }),
});

console.log(await res.json());

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
)

func main() {
    payload, _ := json.Marshal(map[string]string{
        "to":   "+625551234567",
        "from": "smsroute",
        "text": "Your verification code is 384921",
    })

    req, _ := http.NewRequest("POST",
        "https://api.smsroute.cc/v1/sms/send",
        bytes.NewBuffer(payload))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("SMSROUTE_API_KEY"))
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

<?php
$apiKey = getenv('SMSROUTE_API_KEY');

$payload = json_encode([
    'to'   => '+625551234567',
    'from' => 'smsroute',
    'text' => 'Your verification code is 384921',
], JSON_UNESCAPED_UNICODE);

$ch = curl_init('https://api.smsroute.cc/v1/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
]);

echo curl_exec($ch);
curl_close($ch);

Kominfo PSE Registration — Why Your App Might Need It Before You Send SMS

PSE — Penyelenggara Sistem Elektronik, or Electronic System Operator — is the regulatory designation under which Kominfo (Kementerian Komunikasi dan Informatika, Indonesia's Ministry of Communication and Informatics) catalogs digital services operating in or serving Indonesia. Since Ministerial Regulation 5/2020 and the enforcement crackdown of mid-2022, operating a PSE-scope service without registration carries real consequences — including access blocking at the national DNS level.

What PSE requires. Any platform that (1) processes user transactions, (2) offers digital content, (3) provides communication services, (4) operates a social or user-generated platform, (5) handles financial or payment data, or (6) collects user data from Indonesian users must register with Kominfo's PSE portal. Registration is tiered: Private Scope PSEs are commercial services (most SaaS apps, ecommerce, fintech); Public Scope PSEs are government-affiliated. The Private tier is further split into Strategic (finance, health, critical infra) and Non-Strategic categories, with Strategic carrying in-country data residency obligations.

The 2022 deadline and its consequences. The originally decreed registration deadline was July 2022. In the weeks around that deadline, Kominfo blocked access to several non-registered global services from Indonesian networks — PayPal, Yahoo, Epic Games, Steam, and Dota 2 were among the high-profile blocks, some lasting hours, some days. Yahoo's Indonesian traffic dropped to zero for most of a business day before registration was completed under pressure. The message was clear: Kominfo would enforce by blocking, not by fine-first-question-later. Most global platforms of material user-scale in Indonesia are now registered; the smaller international SaaS ecosystem continues to trickle through compliance.

When it applies to you. If you run a consumer-facing app, website, or SaaS with Indonesian users — even if your company is headquartered in Singapore, Delaware, London, or anywhere else — Kominfo takes the position that PSE applies. The trigger is user presence, not company domicile. If you are a pure B2B backend processing transactions on behalf of other merchants' Indonesian users without a direct user-facing product, the PSE scope is softer and enforcement has historically been lighter. Consult counsel if in doubt — the cost of registration is low; the cost of a block is high.

Registration tiers and data-residency implications. Non-Strategic Private PSEs can store user data outside Indonesia subject to transfer safeguards. Strategic Private PSEs must keep certain data classes in-country — financial transaction records, health records, certain categories of identity data. This is the key tier question for any fintech or healthtech founder eyeing the Indonesian market: registering as Non-Strategic when you're actually Strategic is the exposure worth avoiding. The smsroute SMS delivery layer operates at the transport tier and does not trigger residency obligations at your application layer — but it also does not absorb residency obligations that your app itself carries.

Mobile operators in Indonesia

Indonesia's mobile market is a four-operator field, though the de facto structure is Telkomsel plus three pressed challengers. Consolidation over 2021-2022 reduced the field from five to four after the Indosat-Hutchison merger formed IOH.

Telkomsel. ~48% market share. Subsidiary of Telkom Indonesia, the state-owned telecommunications incumbent. Telkomsel has the most extensive nationwide coverage including the outer islands (Papua, Maluku, Nusa Tenggara) where the challengers struggle with interconnect economics. For A2P, Telkomsel is both the largest destination and the strictest compliance counterparty — sender-ID approval takes 10-14 business days and template content is reviewed manually.

Indosat Ooredoo Hutchison (IOH). ~26% share. Formed in January 2022 by the merger of Indosat Ooredoo and Hutchison 3 Indonesia, creating the country's second-largest operator. IOH inherited both parent networks' interconnect relationships and has been aggressively consolidating spectrum. A2P onboarding is faster than Telkomsel (3-5 business days typical) and somewhat more flexible on template content.

XL Axiata. ~19% share. Subsidiary of Malaysia's Axiata Group. Strong Java and Sumatra coverage. Historically the most A2P-friendly of the four for low-volume senders — sender-ID registration runs 3-7 business days and the fee structure is lighter.

Smartfren. ~7% share. The smallest of the four, part of the Sinar Mas Group. Smartfren runs on a modern 4G/5G stack but with thinner geographic coverage outside the main urban centers. For A2P, Smartfren interconnect is functional but higher-latency; sender-ID onboarding is the lightest-touch of the four.

Mobile operators in Indonesia

Indonesia's mobile market is a four-operator field, though the de facto structure is Telkomsel plus three pressed challengers. Consolidation over 2021-2022 reduced the field from five to four after the Indosat-Hutchison merger formed IOH.

Telkomsel. ~48% market share. Subsidiary of Telkom Indonesia, the state-owned telecommunications incumbent. Telkomsel has the most extensive nationwide coverage including the outer islands (Papua, Maluku, Nusa Tenggara) where the challengers struggle with interconnect economics. For A2P, Telkomsel is both the largest destination and the strictest compliance counterparty — sender-ID approval takes 10-14 business days and template content is reviewed manually.

Indosat Ooredoo Hutchison (IOH). ~26% share. Formed in January 2022 by the merger of Indosat Ooredoo and Hutchison 3 Indonesia, creating the country's second-largest operator. IOH inherited both parent networks' interconnect relationships and has been aggressively consolidating spectrum. A2P onboarding is faster than Telkomsel (3-5 business days typical) and somewhat more flexible on template content.

XL Axiata. ~19% share. Subsidiary of Malaysia's Axiata Group. Strong Java and Sumatra coverage. Historically the most A2P-friendly of the four for low-volume senders — sender-ID registration runs 3-7 business days and the fee structure is lighter.

Smartfren. ~7% share. The smallest of the four, part of the Sinar Mas Group. Smartfren runs on a modern 4G/5G stack but with thinner geographic coverage outside the main urban centers. For A2P, Smartfren interconnect is functional but higher-latency; sender-ID onboarding is the lightest-touch of the four.

Sender ID rules + Telkomsel's stricter approval

Alphanumeric sender IDs of up to 11 characters (Latin alphabet, no spaces) are supported across all four Indonesian operators. Per-operator registration is recommended but not uniformly enforced — unregistered IDs deliver on IOH, XL, and Smartfren with minimal rewrite, while Telkomsel is increasingly rewriting unregistered senders to a generic pool.

IOH, XL Axiata, and Smartfren each run their own sender-ID registries but with lighter review — typical 3-7 business day turnaround and higher first-submission approval rates. smsroute handles the filings through partner channels for customers who don't have a local Indonesian business entity to submit directly; the operator fees (typically IDR 300,000-800,000 one-time per ID per operator) are passed through at cost.

UU 27/2022 — Indonesia's Personal Data Protection Law Compared to GDPR

UU 27/2022 is the Indonesian Personal Data Protection Law, the country's first omnibus personal-data statute. It was enacted October 2022 after years of legislative drift, and its two-year implementation runway closed October 2024 — meaning the substantive obligations are now fully in force.

Similarities to GDPR. UU 27/2022 was drafted with GDPR explicitly as a reference model. Similarities include: explicit consent as the primary lawful basis for personal data processing; a full set of data subject rights (access, correction, deletion, portability, right to object); a mandatory Data Protection Officer for large processors; extraterritorial scope (applies to processing of Indonesian-resident data regardless of where the processor sits); and a tiered administrative-fine regime.

Key differences. Several meaningful departures from GDPR exist. (1) No explicit Data Protection Impact Assessment requirement — where GDPR mandates a DPIA for high-risk processing, UU 27/2022 expects internal risk assessment but does not prescribe the DPIA instrument. (2) Breach notification window is 72 hours (3x24 hours in Indonesian legal phrasing) to the authority and to affected data subjects, similar on paper but with a stronger consumer-notification mandate than GDPR's "without undue delay" standard. (3) Administrative fine cap is 2% of annual revenue, half of GDPR's 4%. (4) Explicit consent requirements are more prescriptive — UU 27/2022 requires consent to be specific, informed, unambiguous, and recorded, with an explicit right to withdraw. (5) The Indonesian Data Protection Agency (PDP Agency) is still in the build-out phase as of 2026; enforcement is less predictable than a mature European DPA, which cuts both ways — lower immediate probability of investigation, higher tail risk of politically-directed enforcement.

UU 27/2022 — Indonesia's Personal Data Protection Law Compared to GDPR

UU 27/2022 is the Indonesian Personal Data Protection Law, the country's first omnibus personal-data statute. It was enacted October 2022 after years of legislative drift, and its two-year implementation runway closed October 2024 — meaning the substantive obligations are now fully in force.

Similarities to GDPR. UU 27/2022 was drafted with GDPR explicitly as a reference model. Similarities include: explicit consent as the primary lawful basis for personal data processing; a full set of data subject rights (access, correction, deletion, portability, right to object); a mandatory Data Protection Officer for large processors; extraterritorial scope (applies to processing of Indonesian-resident data regardless of where the processor sits); and a tiered administrative-fine regime.

Key differences. Several meaningful departures from GDPR exist. (1) No explicit Data Protection Impact Assessment requirement — where GDPR mandates a DPIA for high-risk processing, UU 27/2022 expects internal risk assessment but does not prescribe the DPIA instrument. (2) Breach notification window is 72 hours (3x24 hours in Indonesian legal phrasing) to the authority and to affected data subjects, similar on paper but with a stronger consumer-notification mandate than GDPR's "without undue delay" standard. (3) Administrative fine cap is 2% of annual revenue, half of GDPR's 4%. (4) Explicit consent requirements are more prescriptive — UU 27/2022 requires consent to be specific, informed, unambiguous, and recorded, with an explicit right to withdraw. (5) The Indonesian Data Protection Agency (PDP Agency) is still in the build-out phase as of 2026; enforcement is less predictable than a mature European DPA, which cuts both ways — lower immediate probability of investigation, higher tail risk of politically-directed enforcement.

Pricing vs competitors

Prices as of April 2026 from each provider's public pricing page. smsroute lands ~44% below Twilio and 23% below Plivo on Indonesian routes. The PSE/UU 27 advisory is the practical add-on for founders shipping their first Indonesian integration — not legal advice, but enough structure to ask counsel the right questions.

Related pages

• SMS pricing (all 149 countries)
• Send SMS to Philippines · Send SMS to India · Send SMS to Nigeria
• smsroute vs Twilio

Related

Related

import requests, os

r = requests.post(
    "https://api.smsroute.cc/v1/messages",
    headers={"Authorization": f"Bearer {os.environ['SMSROUTE_API_KEY']}"},
    json={
        "to": "+6281234567890",
        "from": "ACMEID",
        "body": "Kode OTP Acme Anda: 384921. Berlaku 10 menit."
    }
)
print(r.json())

curl -X POST https://api.smsroute.cc/v1/messages \
  -H "Authorization: Bearer $SMSROUTE_API_KEY" \
  -d '{
    "to": "+6281234567890",
    "from": "ACMEID",
    "body": "Kode OTP Acme Anda: 384921. Berlaku 10 menit."
  }'

import fetch from "node-fetch";

const apiKey = process.env.SMSROUTE_API_KEY;

const res = await fetch("https://api.smsroute.cc/v1/sms/send", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${apiKey}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    to: "+625551234567",
    from: "smsroute",
    text: "Your verification code is 384921",
  }),
});

console.log(await res.json());

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
)

func main() {
    payload, _ := json.Marshal(map[string]string{
        "to":   "+625551234567",
        "from": "smsroute",
        "text": "Your verification code is 384921",
    })

    req, _ := http.NewRequest("POST",
        "https://api.smsroute.cc/v1/sms/send",
        bytes.NewBuffer(payload))
    req.Header.Set("Authorization", "Bearer "+os.Getenv("SMSROUTE_API_KEY"))
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil { panic(err) }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

<?php
$apiKey = getenv('SMSROUTE_API_KEY');

$payload = json_encode([
    'to'   => '+625551234567',
    'from' => 'smsroute',
    'text' => 'Your verification code is 384921',
], JSON_UNESCAPED_UNICODE);

$ch = curl_init('https://api.smsroute.cc/v1/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $payload,
]);

echo curl_exec($ch);
curl_close($ch);

Kominfo PSE Registration — Why Your App Might Need It Before You Send SMS

PSE — Penyelenggara Sistem Elektronik, or Electronic System Operator — is the regulatory designation under which Kominfo (Kementerian Komunikasi dan Informatika, Indonesia's Ministry of Communication and Informatics) catalogs digital services operating in or serving Indonesia. Since Ministerial Regulation 5/2020 and the enforcement crackdown of mid-2022, operating a PSE-scope service without registration carries real consequences — including access blocking at the national DNS level.

What PSE requires. Any platform that (1) processes user transactions, (2) offers digital content, (3) provides communication services, (4) operates a social or user-generated platform, (5) handles financial or payment data, or (6) collects user data from Indonesian users must register with Kominfo's PSE portal. Registration is tiered: Private Scope PSEs are commercial services (most SaaS apps, ecommerce, fintech); Public Scope PSEs are government-affiliated. The Private tier is further split into Strategic (finance, health, critical infra) and Non-Strategic categories, with Strategic carrying in-country data residency obligations.

The 2022 deadline and its consequences. The originally decreed registration deadline was July 2022. In the weeks around that deadline, Kominfo blocked access to several non-registered global services from Indonesian networks — PayPal, Yahoo, Epic Games, Steam, and Dota 2 were among the high-profile blocks, some lasting hours, some days. Yahoo's Indonesian traffic dropped to zero for most of a business day before registration was completed under pressure. The message was clear: Kominfo would enforce by blocking, not by fine-first-question-later. Most global platforms of material user-scale in Indonesia are now registered; the smaller international SaaS ecosystem continues to trickle through compliance.

When it applies to you. If you run a consumer-facing app, website, or SaaS with Indonesian users — even if your company is headquartered in Singapore, Delaware, London, or anywhere else — Kominfo takes the position that PSE applies. The trigger is user presence, not company domicile. If you are a pure B2B backend processing transactions on behalf of other merchants' Indonesian users without a direct user-facing product, the PSE scope is softer and enforcement has historically been lighter. Consult counsel if in doubt — the cost of registration is low; the cost of a block is high.

Registration tiers and data-residency implications. Non-Strategic Private PSEs can store user data outside Indonesia subject to transfer safeguards. Strategic Private PSEs must keep certain data classes in-country — financial transaction records, health records, certain categories of identity data. This is the key tier question for any fintech or healthtech founder eyeing the Indonesian market: registering as Non-Strategic when you're actually Strategic is the exposure worth avoiding. The smsroute SMS delivery layer operates at the transport tier and does not trigger residency obligations at your application layer — but it also does not absorb residency obligations that your app itself carries.

Pricing vs competitors

Prices as of April 2026 from each provider's public pricing page. smsroute lands ~44% below Twilio and 23% below Plivo on Indonesian routes. The PSE/UU 27 advisory is the practical add-on for founders shipping their first Indonesian integration — not legal advice, but enough structure to ask counsel the right questions.

Latency + delivery success

From our Singapore POP, median round-trip latency and delivery success by operator:

• Telkomsel: 264 ms median, 98.5% success
• IOH: 281 ms median, 98.1% success
• XL Axiata: 295 ms median, 98.0% success
• Smartfren: 351 ms median, 97.6% success

Aggregate: 279 ms median, 760 ms 95th percentile, 98.2% delivery success. The bulk of the remaining 1.8% is handsets off-coverage in the eastern archipelago (Papua, Maluku) and during the afternoon brownout windows that still occur in several regional networks.

Sender ID rules + Telkomsel's stricter approval

Alphanumeric sender IDs of up to 11 characters (Latin alphabet, no spaces) are supported across all four Indonesian operators. Per-operator registration is recommended but not uniformly enforced — unregistered IDs deliver on IOH, XL, and Smartfren with minimal rewrite, while Telkomsel is increasingly rewriting unregistered senders to a generic pool.

IOH, XL Axiata, and Smartfren each run their own sender-ID registries but with lighter review — typical 3-7 business day turnaround and higher first-submission approval rates. smsroute handles the filings through partner channels for customers who don't have a local Indonesian business entity to submit directly; the operator fees (typically IDR 300,000-800,000 one-time per ID per operator) are passed through at cost.

Latency + delivery success

From our Singapore POP, median round-trip latency and delivery success by operator:

• Telkomsel: 264 ms median, 98.5% success
• IOH: 281 ms median, 98.1% success
• XL Axiata: 295 ms median, 98.0% success
• Smartfren: 351 ms median, 97.6% success

Aggregate: 279 ms median, 760 ms 95th percentile, 98.2% delivery success. The bulk of the remaining 1.8% is handsets off-coverage in the eastern archipelago (Papua, Maluku) and during the afternoon brownout windows that still occur in several regional networks.

Frequently asked questions

Frequently asked questions

Related pages

• SMS pricing (all 149 countries)
• Send SMS to Philippines · Send SMS to India · Send SMS to Nigeria
• smsroute vs Twilio

Related

Related

Related

Related