---
name: sms-verification-automation
description: Automated SMS verification for service activation via SMS providers (HeroSMS, GrizzlySMS, 365sms) and ADB-controlled Android device. Covers MyJio and Gemini but generalises to any app requiring SMS OTP.
trigger: User asks to verify a phone number, get OTP, activate a service via SMS, or automate login with phone verification.
---

# SMS Verification Automation

Automate SMS-based phone verification for any service using SMS activation providers and ADB-controlled Android device.

## References
- `references/credentials.md` — account credentials for all SMS providers
- `references/pvacodes-api-jiofarm.md` — PVACodes API (TLS-blocked, browser-bridge required), Jio service prices India, jiofarm integration (2026-09-19)
- `references/2nd-no-free-polish-numbers.md` — **2nd-no.com: бесплатные польские номера** (5/день, 3 дня живёт), полный Playwright-флоу реги/логина/модала номера, API-карта 2no.pl (JSON-RPC), tempmail.lol v2 query-token питфолл (2026-09-19)

## Бесплатные веб-SMS сервисы (без балансов/платежей)

- **2nd-no.com** (Польша, +48) — рега по email, 5 бесплатных номеров/день, живут 3 дня, продлеваются при входящем SMS. Только через браузер (API за Cloudflare). Полный playbook: `references/2nd-no-free-polish-numbers.md`.
- Каталог остальных бесплатников (temp-number.com, quackr.io, sms-activate.guru free и их статусы): skill `cybersec/temp-sms-free`.
- Правило: крупные сервисы (Google/Facebook/GitLab) часто режут VoIP/фри-номера — проверять доставку до массового использования.
- Resend-троттл живёт на ЦЕЛЕВОМ пользователе, не на номере: сервисы (WorkOS-класс) рисуют «код отправлен» на verify-странице, но молча не доставляют повторные SMS тому же user в пределах ~1-2ч — ротация номера не помогает и только жжёт слоты. Ждать cooldown или верифицировать нового user (новый аккаунт = SMS доставляется сразу).
- **Twilio-based верификация (MLH и подобные US-платформы) — блок КАТЕГОРИЧЕСКИЙ**: арендные/виртуальные номера не получают SMS НИ в одной стране (add/resend возвращают 200, SMS не приходит никогда; проверено на 8 номерах/7 стран hero-sms, включая пулы с 25k+ physicalCount). НЕ итерировать страны — сразу реальная SIM (попросить юзера продиктовать один код). Мёртвый рент возвращает ban+refund (`setStatus status=8`). Детали: skill `ai-provider-autoreg` → `references/mlh-ghw-promo-claim.md`.

## Providers (ordered by effectiveness for Jio/Indian services)

| Provider | API URL | Key Location | Best For | Notes |
|----------|---------|--------------|----------|-------|
| GrizzlySMS | `api.grizzlysms.com/stubs/handler_api.php` | Account → Settings → API tab | MyJio, real SIM cards | Requires browser login to get key; MyJio is dedicated service |
| HeroSMS | `hero-sms.com/stubs/handler_api.php` | User provides | General | DO NOT use `herosms.com` (wrong domain) |
| 365sms | `365sms.org/stubs/handler_api.php` | In `HEROSMS_CLIENT_GPT55_Gothbreach.py` | General | Jio OTP does NOT arrive on this provider |
| PVACodes | `beta.pvacodes.com/app/api.php` | Дашборд ?page=user/api (Влад: [REDACTED-NAME]@gmail.com) | India ($0.16-0.33), 50+ стран | **TLS(JA3)-блок: только через Playwright bridge** :18085 (API, `credentials:'omit'` — include ломает ключ) + :18086 (дашборд, persistent_context). См. references/pvacodes-api-jiofarm.md |

All three use sms-activate compatible API protocol.

## Crucial Pitfall: Jio Blocks Virtual Numbers

**Jio (MyJio) checks if the phone number is a real Jio subscriber.** Virtual numbers from HeroSMS/365sms will NOT receive the OTP — the SMS is never sent. Status will be `STATUS_WAIT_CODE` indefinitely or `STATUS_CANCEL`.

**PVACodes Jio-сервисы: ВСЕ 9 купленных номеров (Jio11/JIO7/Jio17/Jio19/JioSaavn7) = НЕ Jio-абоненты** (2026-09-19 финал: sendOtp → `400 INVALID_JIONUMBER_ERROR`). Jio17 отдаёт ПОЛНЫЙ номер прямо из API (`+916393438597`), в отличие от маскированных Jio11/JIO7 (+919****1247). Все Jio-сервисы в каталоге имеют success_count=0. `cancel_number` = полный авто-рефанд пока код не получен, НО не раньше 60с после покупки («Please wait 60 more seconds before cancelling») — в скриптах ждать 65с. Out of Stock деньги не списывает. Rent-каталог India пуст. PVACodes для Jio = мёртвый путь. Детали: `references/pvacodes-api-jiofarm.md`.

**Only GrizzlySMS explicitly supports MyJio** with real SIM cards (Airtel/Jio/Vodafone). It is the only provider observed to have a chance of receiving Jio OTP.

**Дешёвый pre-check любого номера на Jio (до покупки следующего):** POST `https://www.jio.com/api/jio-login-service/login/sendOtp` body `{"mobileNumber":"<10 цифр>","loginFlowType":"MOBILE","alternateNumber":""}` (формат подтверждён сетевым перехватом с jio.com/selfcare/login). Ответ `INVALID_JIONUMBER_ERROR` = номер не Jio → cancel+refund. Это валидация за $0 вместо ожидания OTP 120с.

## GrizzlySMS Setup

### Registration
1. Open `https://grizzlysms.com/registration` in browser (Chrome DevTools MCP works)
2. Fill: Name, Email (use guerrillamail.com), Password, Confirm Password
3. Check both checkboxes (privacy + public offer)
4. Click Registration
5. Accept cookie banner if present

### Getting API Key
1. Log in at `https://grizzlysms.com/authorization`
2. Navigate to Settings → API tab
3. Copy API key (readonly textbox, format: 32-char hex)

### Top-Up
- Balance is $0 after registration
- Click "Top Up balance" in header
- Minimum deposit required (check UI)

### API Usage
```
# Check balance
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"

# Get MyJio number — use service code from web UI (not 'myjio' in API)
# Check the service code in the Price page or web UI
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"

# Poll for SMS
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"
```

## HeroSMS Usage

Domain: `hero-sms.com` (NOT `herosms.com` — connection reset).

```
# Check balance
curl "https://hero-sms.com/stubs/handler_api.php?api_key=[REDACTED]"

# Get number for India (country=22), try any service
curl "https://hero-sms.com/stubs/handler_api.php?api_key=[REDACTED]"

# Services with most Indian numbers: tg, li, go, ig, dr, wb, vk
# But Jio OTP will NOT arrive on these — use only for non-Jio services
```

## Android Device Control via ADB

### Device Info
- Model: Xiaomi 24117RN76E (Android 15, MIUI)
- Serial: `furcwslfnn6d7drk`
- ADB path: `C:/Users/User/AppData/Local/Android/Sdk/platform-tools/adb.exe`
- Resolution: 1080x2400

### Critical: ADB from execute_code vs terminal
- `execute_code` sandbox CANNOT connect to ADB — commands time out
- Use `terminal` tool for ALL ADB commands
- Always use full path to adb.exe

### Essential ADB Commands
```bash
ADB="C:/Users/User/AppData/Local/Android/Sdk/platform-tools/adb.exe"
DEV="furcwslfnn6d7drk"

# Wake device
"$ADB" -s "$DEV" shell input keyevent 26

# Launch MyJio (monkey works, am start may fail)
"$ADB" -s "$DEV" shell monkey -p com.jio.myjio 1

# Tap coordinates (MyJio: number field ~540,1100; Generate OTP ~540,1400)
"$ADB" -s "$DEV" shell input tap X Y

# Enter text
"$ADB" -s "$DEV" shell input text "PHONE_NUMBER"

# Delete characters
"$ADB" -s "$DEV" shell input keyevent 67  # KEYCODE_DEL

# Check screen state
"$ADB" -s "$DEV" shell dumpsys power | grep mWakefulness
# "Awake" = screen on, "Asleep" = screen off → wake with keyevent 26

# Screenshot (may be black due to FLAG_SECURE)
"$ADB" -s "$DEV" shell screencap -p /sdcard/screen.png
"$ADB" -s "$DEV" pull /sdcard/screen.png "C:/Users/User/screen.png"
```

### MyJio App Quirks
- Package: `com.jio.myjio`
- Installed via Xiaomi GetApps (not Google Play)
- Version: 8.0.37
- **FLAG_SECURE enabled** — screenshots show black screen
- Login flow: enter number → "Generate OTP" → OTP screen → auto-reads SMS from device
- No Skip/Guest option on start screen
- "Try another way to get OTP" → "Get OTP on call" option exists but doesn't work with virtual numbers

## OTP Polling Pattern

```bash
ACT_ID="activation_id"
for i in $(seq 1 30); do
  sleep 4
  resp=$(curl -s --max-time 10 "https://API_URL?api_key=[REDACTED]")
  if [ $((i % 5)) -eq 0 ]; then echo "[$i] $resp"; fi
  if echo "$resp" | grep -q "STATUS_OK"; then
    code=$(echo "$resp" | cut -d: -f2)
    echo "OTP: $code"
    # Enter code on device
    "$ADB" -s "$DEV" shell input text "$code"
    break
  elif [ "$resp" != "STATUS_WAIT_CODE" ]; then
    echo "[$i] $resp"
    break
  fi
done
```

Status codes: `STATUS_WAIT_CODE` (waiting), `STATUS_OK:CODE` (SMS received), `STATUS_CANCEL` (expired/failed).

## Helicopter View: Decision Tree

```
Need SMS OTP?
├── Is it Jio/MyJio?
│   ├── YES → GrizzlySMS only (real SIM cards needed)
│   │   ├── PVACodes/365sms/HeroSMS = non-Jio номера (INVALID_JIONUMBER_ERROR, проверено)
│   │   └── Need to top up balance first (min deposit ~$5-10)
│   ├── Sender is Twilio-based (MLH etc.)?
│   │   └── YES → REAL SIM only (virtual numbers = zero SMS in ANY country)
│   └── NO → HeroSMS or 365sms (virtual numbers work for most services)
│       ├── HeroSMS: hero-sms.com, ~$4.20 balance
│       └── 365sms: 365sms.org, ~$0.52 balance
└── Need browser interaction?
    └── Use Chrome DevTools MCP (mcp__chrome_devtools__*)
        NOT execute_code (sandbox has network restrictions)
```