Features

SMS and email for Canada, from one API

Two products on one account: text messages to and from Canadian mobile numbers, and email sent and received on your own domain. CASL and PIPEDA are enforced inside the API, and your data is stored in Canada, in Montréal (ca-central-1).

Start free View API docs

SMS

Two-way text messaging to Canadian mobile numbers, from Canadian numbers you provision through the API.

Outbound SMS: Send to any Canadian mobile number in E.164 format.
Inbound SMS: Receive inbound messages via webhook. Reply-to threading included.
Test mode: Validate messages without sending. Unlimited test messages.
Idempotency keys: Send an Idempotency-Key header on every request that might be retried: the same key returns the original message instead of sending and charging again.
Delivery receipts: Real-time status: queued → sent → delivered or failed.
Message history: Search and filter sent messages by date, number, or status.
Canadian phone numbers: Local numbers in every province and toll-free numbers Canada-wide (SMS after verification), provisioned through the API in seconds.
Phone verification (OTP): Send a one-time code and check it: two calls. Codes expire after 10 minutes.

Email

Email on your own domain, both ways: receipts, password resets and notices out, and the replies back in. A commercial email goes out only with CASL consent on file.

Transactional by default: Receipts, resets and notices send without consent paperwork. Mark an email commercial and HonkIO requires CASL consent on file, adds the unsubscribe footer and honours one-click unsubscribe.
Your own domain: DKIM and a return path on your domain, verified in minutes. Nothing on your root domain’s mail setup changes.
A receiving address, ready now: Every account gets a managed inbound address with nothing to set up, and any name before the @ reaches it. Each message arrives as an email.received webhook; fetch the body, attachments and SPF, DKIM, DMARC and spam verdicts by id.
Receive on your own domain: Turn on receiving for a domain you already send from and publish one MX record; a subdomain keeps your main mailboxes where they are. Received mail is stored in Canada: bodies for 90 days, the raw message and attachments for 40.
Templates with versions: Store templates with declared variables. Edits save to a draft, publishing creates a numbered version, and rolling back is one call.
Batches and scheduling: Up to 100 emails in one batch call. Schedule a send up to 30 days ahead, then move or cancel it while it waits. Cancelling refunds the charge.
Test mode that behaves like the real thing: Send from a sandbox address to magic recipients and watch deliveries, bounces and complaints arrive as webhooks, before touching DNS.
Suppression and automatic pause: Hard bounces and spam complaints add an address to your suppression list, and no email goes to it again; an unsubscribe blocks commercial email only. If recent live email bounces or draws complaints at a high rate, live sending pauses for 24 hours and a webhook tells you why.

Both channels

What SMS and email share: one account, the same compliance rules and one place your data is stored.

Stored in Canada: Text messages, email records, consent and suppression lists are stored in Canada, in Montréal (ca-central-1). One data residency answer covers both channels.
CASL on both channels: Consent is recorded once per phone number or email address. A commercial send with no consent on file is refused before anything is charged.
SMS and email on one account: One prepaid balance in CAD, one set of API keys, one webhook feed for both channels.
One webhook feed: Every SMS and email event, from delivered to bounced, opened or unsubscribed, arrives HMAC-signed on the same endpoints and is retried with backoff.
MCP server and Node SDK: Let Claude, Cursor or Copilot send SMS and email through the HonkIO MCP server, or call both channels from @honkio/node.
Live and test keys: One set of keys for both channels, with scoped permissions, and a key can be limited to specific sending domains. Test keys send nothing and charge nothing.
Audit log and rate limits: Every key action and compliance event is logged immutably, and every account has its own rate limits.
Erasure in one call: Built for PIPEDA and Quebec Law 25: erase a phone number's data in one API call, and email content is purged on its own after 90 days.

CASL Consent Management

Consent tracking: Record express and implied consent with full audit trail.
Auto opt-out: STOP/STOPALL/UNSUBSCRIBE/QUIT/END/CANCEL and French ARRET/ARRÊT keywords processed automatically.
Consent expiry: Implied consent auto-expires after 2 years per CASL §10(9).
DNCL checking (coming soon): Automated CRTC Do Not Call List screening before telemarketing sends is coming soon.
HTTP 451 blocks: Non-compliant sends rejected with legally appropriate status code.
Right to erasure: Scrub message bodies and delete consent, verification and contact records for a phone number; the CASL opt-out itself is kept.

Webhooks & Delivery Receipts

Event subscriptions: SMS: message.queued, message.sending, message.sent, message.delivered, message.failed, message.undelivered, message.received. Email: email.queued, email.sent, email.delivered, email.delivery_delayed, email.bounced, email.complained, email.rejected, email.failed, email.opened, email.clicked, email.unsubscribed, email.cancelled, email.rescheduled, email.received, email_domain.verified, email_domain.verification_failed, email_domain.receiving_verified, email_domain.receiving_failed. Account: opt_out.recorded, opt_out.reinstated, consent.double_opt_in_confirmed, account.delivery_warning, account.sending_paused, account.spend_warning, account.inbound_email_capped, account.auto_topup_succeeded, account.auto_topup_paused, phone_number.suspended, phone_number.released, toll_free_verification.changes_requested, toll_free_verification.approved, toll_free_verification.rejected.
HMAC signatures: Every webhook payload is signed with your account secret. Verify authenticity.
Retry logic: Failed webhook deliveries are retried with exponential backoff.
Multiple endpoints: Register multiple webhook URLs per event type.
Delivery logs: Inspect all webhook delivery attempts in your dashboard.
Dead-letter replay: Replay any event that exhausted its three delivery attempts, or drop it, from your dashboard or the API.

Authentication & Security

API key types: Live keys (mk_live_...) and test keys (mk_test_...) per account.
Scoped keys: Issue send-only, read-only, or admin-scoped keys.
Key revocation: Rotate or revoke keys anytime without downtime.
Rate limiting: Per-account rate limits with sliding window algorithm.
Audit log: Every key action and compliance event is logged immutably.
Canadian data residency: All auth data stored in Canada (ca-central-1).

Developer-First REST API

OpenAPI spec: Full OpenAPI 3.1 spec available for code generation.
Bilingual errors: All error messages returned in EN and FR (Accept-Language).
Structured errors: Consistent error format with code, message, and details fields.
Swagger UI: Interactive API explorer (Swagger UI) at api.honkio.ca/docs.
Idiomatic REST: Standard HTTP methods, status codes, and pagination.
curl-friendly: Designed to be simple enough to test with curl and a Bearer token.
MCP server for AI agents: Let Claude, Cursor or Copilot send SMS, verify numbers and check CASL consent directly. Published on npm, with no SDK to wire up.

Canadian Phone Numbers

Number search: Search available Canadian numbers by area code or province.
Instant provisioning: Provision a number via API in seconds. Active immediately.
Number release: Release numbers you no longer need. Billing stops immediately.
Canadian only: Only Canadian area codes accepted. All 60+ NPA codes validated.
Multi-number accounts: Provision as many numbers as your plan allows.
Short codes: Short code (5-6 digit) campaigns available on request.

Phone Number Verification (OTP)

OTP via SMS: Send a one-time code to any Canadian number. Configurable length of 4 to 8 digits.
Check endpoint: Submit the code to confirm. The response returns the verified status and attempts remaining.
Expiry & attempt limits: Codes expire after 10 minutes. 5 attempts before lockout.
Test mode support: In test mode the code is always zeros (e.g. 000000). No SMS sent.
Audit trail: All verification requests and outcomes logged immutably.
Simple two-step API: POST /verify to start, POST /verify/{id}/check to confirm. That’s it.

Start sending compliant SMS and email in Canada

Create free account

Test keys work without a card. Read the API docs →