How do I set up country & rate limiting?

Learn how to configure country & rate limiting to ensure that your GatewayAPI account can only send SMS messages to countries or with the rate limit that you have explicitly approved.

This security feature prevents your account from being used to send SMS messages to blocked countries – even if your API keys are compromised or you’re targeted by a SMS pumping /AIT attack.

Please note that by default, all countries are allowed when you create a new account. If you want to restrict access, you must manually select your permitted countries.

Please also note that to use the rate limiting feature, you need to use the new Mobile Messaging API.

See our step-by-step guide below with all the details on how to set up country & rate limiting.

Step 1: Navigate to Country & Rate Limiting in the dashboard

Go to the tool by clicking on “SMS” → “Country & Rate Limiting.”.

Step 2: Enable country & rate limiting

Tick the box with the text “Country & Rate Limiting”

Step 3: Choose the countries you want to send messages to

You can either search for the countries in the search field or choose them from the list. You add a country on the “allowed” list by clicking on it so it appears in the column on the right. If you want to remove a country from the “allowed” list, you can simply click on it again.

Step 4: Set rate limits (optional)

• Click the three dots next to the country under Actions → Edit limit.
• Switch to Daily Limit and enter the desired number of messages.
• Click Save.

Note: This feature is not supported on the REST API.

No, this is a free feature.

If an SMS is sent to a country not included on your “allowed countries” list, the request will return a 422 HTTP error. The message will not be delivered or charged. This also applies to bulk messages: if even one recipient is in a blocked country, none of the messages in that batch will be sent or billed.

If the recipient of the message is traveling and is in a country that you have blocked, the message will still be delivered. This is because any blocking takes place in our system before the message is sent, based on the mobile number’s country code (e.g., +45), and not on the recipient’s current location.

When your outbound volume hits the configured daily cap for a destination, our system stops subsequent messages from processing. You incur zero charges for these blocked outbound attempts.

We send a delivery report (DLR) webhook for every blocked message. The webhook provides error code 0x1908 alongside the message: 

“Destination blocked – geo restrictions applied”.

All country counters reset automatically every day at 00:00 UTC. As soon as midnight UTC arrives, your configured daily quotas refresh, allowing normal message routing to resume right away.

Yes. You can configure the “rest of the world” setting to assign a single default daily rate limit per country across all remaining destinations simultaneously.

This helps protect your account from fraud, while still allowing you to send messages to all countries.

Rate limits apply strictly to SMS traffic submitted through these options:

• Mobile Messaging API
• SMPP

If you send traffic through our legacy REST API, countries on your allowed list remain unlimited under the standard country limiting setup. Read our guide here on how to change from the REST API to our new Mobile Messaging API. 

RCS messaging is not included in the tool, and therefore remains entirely unrestricted across all connections.

Concatenated SMS messages can occasionally cause a brief, intentional cap overflow. For example, if your limit stands at 100 messages and you have sent 99, a two-segment message will pass through successfully. This brings your daily number of messages to 101, after which all subsequent outbound attempts to that country face immediate blocks.

No. Raising a daily rate limit permits new traffic to flow through immediately. However, it does not trigger a resend of messages rejected earlier in the day. Dropped messages remain permanently cancelled.