Phonekit vs building it yourself on a phone number API

Compare the two

The code you write to build it

This is the usual minimum with an SMS API provider such as Twilio, using its twilio Node library. First, a webhook that checks each request really came from the provider and stores the text. Twilio signs every webhook with an X-Twilio-Signature header, sends the fields as a form post, and expects TwiML back.

const express = require("express")
const twilio = require("twilio")
const { Pool } = require("pg")
 
const db = new Pool({ connectionString: process.env.DATABASE_URL })
const app = express()
app.use(express.urlencoded({ extended: false }))
 
app.post("/sms", async (req, res) => {
  const valid = twilio.validateRequest(
    process.env.TWILIO_AUTH_TOKEN,
    req.header("X-Twilio-Signature") ?? "",
    "https://sms-tests.example.com/sms", // the exact URL set on the number
    req.body
  )
  if (!valid) return res.status(403).end()
 
  await db.query(
    "insert into sms_messages (sid, to_number, body, received_at) values ($1, $2, $3, now())",
    [req.body.MessageSid, req.body.To, req.body.Body]
  )
  res.type("text/xml").send("<Response></Response>")
})
 
app.listen(3000)

Then a test helper that pulls the code out of the text and polls until a message newer than the request arrives, or gives up.

import { Pool } from "pg"
 
const db = new Pool({ connectionString: process.env["DATABASE_URL"] })
 
export function extractCode(body: string): string | null {
  return body.match(/\b(\d{4,8})\b/)?.[1] ?? null
}
 
export async function waitForSmsCode(to: string, after: Date, timeoutMs = 120_000) {
  const deadline = Date.now() + timeoutMs
  while (Date.now() < deadline) {
    const { rows } = await db.query(
      "select body from sms_messages where to_number = $1 and received_at > $2 order by received_at limit 1",
      [to, after]
    )
    const code = rows[0] ? extractCode(rows[0].body) : null
    if (code) return code
    await new Promise((resolve) => setTimeout(resolve, 1_000))
  }
  throw new Error(`No SMS code for ${to} within ${timeoutMs} ms`)
}

const after = new Date()
await page.getByRole("button", { name: "Send code" }).click()
const code = await waitForSmsCode(process.env["TEST_PHONE_NUMBER"]!, after)

That is about 50 lines, and it still leaves work out:

• A table and a host. The webhook needs a public HTTPS address that is up whenever a test runs, and the database needs the sms_messages table.
• Clocks. after comes from the test machine and received_at from the database, so a few seconds of clock skew can make a test miss its code or read an old one.
• Code formats. One regular expression won't fit every sender. A text with a date or an order number in it can match first.
• Parallel runs. Two tests on one number can read the same code. You still need one number per worker, and a way to hand them out.
• Access and retention. Who can read sms_messages, how long rows stay, and whether the bodies are encrypted are now yours to decide.

The same test with Phonekit

The webhook, the table, the parser and the poll are Phonekit's job. Your test keeps three lines around the action that sends the text.

const after = await number.mark()
await page.getByRole("button", { name: "Send code" }).click()
const code = await number.waitForOtp({ after, timeoutMs: 120_000 })

mark() records a position on Phonekit's side, so the wait never compares two clocks. The Playwright guide has the complete test, and the SDK reference covers errors, timeouts and resends.

What each costs

Prices for building it yourself are from Twilio's US SMS pricing page as of November 2026. The rows without a price are real costs too, but they depend on your team.

Twilio also notes that US A2P 10DLC traffic is subject to registration onboarding fees.

On the number alone, building it yourself costs less. The service around the number is where the time goes.

Choose building it yourself when

• You already run inbound SMS for your product and the webhook exists.
• You need countries or number types Phonekit doesn't offer.
• You want the whole pipeline inside your own infrastructure.
• One test reads one number, with no agents or teammates involved.

Choose Phonekit when

• You'd rather ask for the code than run a service to fetch it.
• A service your product depends on only texts mobile numbers. Phonekit Mobile numbers are real SIM lines on a mobile network.
• Coding agents need codes while they work on your own app, limited to the numbers you choose.
• Tests run in parallel. Give each worker its own number and mark it before the text is sent.
• Teammates need the same numbers. Everyone sees messages in one shared inbox, and numbers stay with the company when people leave.
• You test a product that texts people. Phonekit can text your own numbers, your teammates' verified phones, anyone who texted you in the last 30 days and up to five numbers you add, at 10 texts a minute and 100 a day per number.

No number is accepted by every service. Phonekit is for testing and running your own product, not for verifying accounts on other services.

Sources

As of November 2026:

• Twilio webhook security: the X-Twilio-Signature header, and validateRequest(authToken, signature, url, params) in the Node library.
• Twilio incoming message webhook: form-encoded fields including MessageSid, From, To and Body, with TwiML expected in reply.
• Twilio SMS pricing for the US: $1.15 a month for a long code number, $0.0083 per inbound segment, carrier fees and A2P 10DLC registration fees.
• Phonekit pricing and the SDK reference.