eSIM API Guide 2026: Integrate, Provision, Resell

What is an eSIM API?

An eSIM API is a REST interface between your application and a connectivity provider's provisioning system. Instead of shipping physical SIM cards or manually activating profiles, your backend sends an HTTP request and receives a digital profile (typically as a QR code) that your customer installs on their phone.

For resellers, the API replaces the need to negotiate wholesale agreements with dozens of carriers. You buy packages at wholesale rates, set your retail price, and the API handles activation across 200+ countries. OmaxTelecom's eSIM reseller API — Bappy — uses package-based billing: fixed GB bundles per destination, ideal for travel use cases.

The activation flow

A minimal eSIM API integration has four steps:

1. List packages — fetch available plans for a destination (country code, GB, validity).
2. Activate — POST with package ID and quantity. Response includes ICCID, status, and QR code (LPA string).
3. Deliver — show the QR code to your customer (on-screen, email, or PDF).
4. Confirm — listen for webhook events when the SIM activates on-network.

curl -X POST https://api.omaxtelecom.com/bapi/api/v1/esim/activate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"package_id": "eu-3gb-15d", "quantity": 1}'

Authentication

Bappy uses Bearer token authentication. Sign up at console.omaxtelecom.com, generate sandbox and production API keys, and pass them in the Authorization header. Keys are organization-scoped with full data isolation. For OIDC-based auth (OAuth 2.0 Client Credentials), see Telkor — OmaxTelecom's per-MB connectivity platform for IoT and MVNO use cases.

Webhooks and events

Production eSIM integrations should not poll for status. Configure webhook endpoints to receive real-time events:

• sim.activated — profile installed and connected on-network
• sim.expired — validity period ended
• sim.usage_threshold — data consumption hit a configured limit
• sms.delivered — SMS sent via the SIM profile
• bulk.completed — batch activation finished

Validate webhook signatures, respond with 2xx quickly, and process asynchronously. Full event catalog: developer.omaxtelecom.com.

Sandbox vs production

Always integrate against sandbox first. Bappy provides separate sandbox credentials with the same API shape as production — test activation, webhook delivery, and error handling without spending real credits. Switch to production keys when your checkout flow, QR delivery, and webhook handlers are verified end-to-end. Most teams complete this in 3–7 days.

Build vs buy

Building eSIM infrastructure from scratch means negotiating SM-DP+ agreements, carrier roaming contracts, GSMA compliance, and ongoing profile management. Realistic timeline: 12–24 months and significant CAPEX. Only carriers and licensed MVNOs should consider this path.

For travel apps, OTAs, agencies, and resellers, an eSIM reseller API is the right choice. You get tier-1 backbone coverage (BICS), 2,968 ready-made packages, and a REST API with zero monthly fees. Start with our eSIM API overview, then get your key at Bappy.

Frequently asked questions