Setting Up API to Send SMS From Particular User's Phone Number

First of all, sending SMS messages on behalf of other extensions is forbidden. This means that using the access token of one extension to send SMS message from another extension’s phone number is not allowed. Please refer to this dev guide for details.

In RingCentral platform, a JWT token represents the extension who owns (normally who creates) the token. For SMS messaging, a super admin user can only access other user extensions’ message store to read the messages and message metadata. A super admin cannot send SMS messages on behalf of other user extensions.

For you app, you should implement the code flow authentication which is flexible and scalable for multiple users. Each user will need to login (authenticate) the app at least once, then your app will keep and maintain the user access tokens to keep it valid as long as the user wants to use your app to send SMS messages from their phone number.

With the code flow authentication, after the user successfully logged in your app, your app will receive the token object which contain the access token which is valid for 1 hour, and the refresh token which is valid for 7 days. When the access token expires, you can use the refresh token to get a new token object, which contains the new valid access token and new refresh token with new the expiration time. Example of a token object:

{
   "access_token" : "U1BCMDFUMDRKV1MwMXxzLFSvXdw5PHMsVLEn_MrtcyxUsw",
   "token_type" : "bearer",
   "expires_in" : 3600,
   "refresh_token" : "U1BCMDFUMDRKV1MwMXxzLFL4ec6A0XMsUv9wLriecyxS_w",
   "refresh_token_expires_in" : 604799,
   "scope" : "AccountInfo CallLog ExtensionInfo Messages SMS",
   "owner_id" : "256440016"
}

The owner_id is the extension ID of the user extension. You can use that ID to read the extension’s phone number and send messages from that phone number using the access token of that extension.

You will need to securely save the user tokens in your app database. Every time the app sends a messages, you can retrieve the token, validate the access token and if it expired, then use the refresh token to get a new token object, replace the new token object with the old one in the database, and use the new access token to call the API to send a message.

If your users send SMS messages once a week or more often, your app does not need to deliberately refresh the tokens. Otherwise, create a cronjob or a timer which will automatically refresh the user token periodically (e.g. every 6-day period) to prevent the refresh token from getting expired.