MSG91 and Exotel SMS portal setup runbook

MSG91 and Exotel SMS portal setup runbook tells implementation teams exactly which SMS-provider credentials, sender identities, DLT values, callback settings, SquareOS fields, and go-live evidence are required before SMS can be used for production reminders, dues, OTP-style operational messages, campaigns, or payment-link handoff.

What this page is for

Who should use it

Owner, implementation, communications admin, platform admin, support

Where to find it

MSG91 panel, Exotel Dashboard, SquareOS Admin / MSG91 Setting

Before you start

MSG91 and Exotel SMS portal setup runbook: complete this runbook before a gym treats SMS as production-ready in SquareOS.
MSG91 setup starts in control.msg91.com / SMS and records Authkey, approved sender ID/header, DLT Entity ID, DLT Template ID, MSG91 template or flow id, route/account reference, SMS logs/report access, delivery callback URL, and callback token.
MSG91 DLT/template setup records template name, approved DLT Template ID, exact message body, variables, Unicode/encoding decision, Entity ID, sender header, route, and SquareOS externalTemplateId or smsProviderTemplateId mapping.
Exotel setup starts in Exotel Dashboard / Settings / API and SMS settings and records Account SID, API Key, API Token, API domain/subdomain, approved SMS sender ID, DLT Entity ID, DLT Template ID, status callback URL, and callback token.
Exotel SMS status proof uses Exotel Outbox or SMS SID status lookup plus POST /engagement/sms/exotel/webhook with token or x-webhook-token, providerMessageId or SmsSid, status, and error text when failed.
SquareOS SMS fields map provider values to Channel Account channel SMS, provider MSG91 or Exotel, accountName, externalAccountId route/account or Account SID, configJson route/provider domain/template defaults/webhook verify token, credentialsJson Authkey or API token reference, senderAccount senderValue, and template externalTemplateId or smsProviderTemplateId.
SMS go-live proof requires fake mode off, one real opted-in phone, provider message id, POST /engagement/sms/:provider/webhook callback, DeliveryAttempt update, Message update, CampaignDeliveryLog update when campaign-originated, and no unresolved dead-letter.
India SMS compliance requires approved DLT Entity ID, Sender ID/Header, DLT Template ID, exact approved body and variables, consent or opt-out evidence, quiet-hour policy, and no unapproved marketing copy.
SMS secret handling forbids exposing MSG91 Authkey, Exotel API token, webhook token, raw delivery payload, or provider portal screenshots containing credentials in launch notes, mobile screens, support tickets, analytics, or crash logs.
If MSG91 or Exotel portal labels differ from the runbook, the extraction row must record the current portal path attempted, provider account owner, support ticket id, copied value, SquareOS field, and verification action.

Daily workflow

Confirm whether the gym is contracted for MSG91 or Exotel. Do not create both accounts for the same gym unless the owner and support team have a clear routing reason and both providers will be certified separately.
For MSG91, sign in to control.msg91.com, open the SMS product area, and locate account/authentication settings for Authkey. Record the account owner, account/route reference, and whether the account is production or sandbox/testing.
In MSG91 SMS sender/header settings, confirm the approved sender ID/header. In India DLT setup, record DLT Entity ID, DLT Template ID, exact approved body, variables, route/category, and any Unicode/encoding requirement. The SquareOS SMS body and variable order must match the approved template.
In MSG91 logs/report or callback settings, configure the SquareOS delivery callback URL POST /engagement/sms/msg91/webhook with token query parameter or x-webhook-token as agreed by platform/admin. Record SMS logs/report access so support can compare provider message id with SquareOS DeliveryAttempt.
In SquareOS Admin / MSG91 Setting, create a channel account with channel SMS, provider MSG91, accountName such as MSG91 Live - Main Gym, externalAccountId as MSG91 route/account reference, configJson for route/default DLT/template/webhook token metadata, and credentialsJson containing only the Authkey secret reference.
For Exotel, sign in to Exotel Dashboard, open Settings / API or API Settings, and record Account SID, API Key, API Token, API domain/subdomain or region, and whether the credentials are production. API Token belongs only in the SquareOS secret field or secret manager reference.
In Exotel SMS/DLT settings or onboarding records, confirm sender ID/header, DLT Entity ID, DLT Template ID, approved message body, variables, and any route/category restrictions. Store campaign or utility template mappings in SquareOS templates, not in free-text staff notes.
Configure the Exotel status callback to POST /engagement/sms/exotel/webhook using the platform/admin callback token through ?token= or x-webhook-token. The callback must include a provider message reference such as SmsSid or providerMessageId, status, and error text when failed.
In SquareOS Admin / MSG91 Setting with provider Exotel, create channel SMS, provider Exotel, accountName, externalAccountId as Account SID, configJson for provider domain/route/default template/webhook token metadata, credentialsJson with API key/API token secret references, and sender account senderValue as the approved sender header.
Create or sync SquareOS SMS templates for OTP-style operational messages, appointment reminders, class reminders, renewal notices, invoice due, payment link, trial follow-up, freeze/cancellation status, and campaign messages. Each template should store externalTemplateId or smsProviderTemplateId for the approved MSG91/Exotel/DLT template id.
Send one live test SMS to an opted-in internal phone with fake mode off. Capture provider message id, delivery callback request id, SquareOS DeliveryAttempt, Message status, CampaignDeliveryLog row if campaign-originated, outbox/dead-letter status, and owner/support approver.
Record official source references used for the extraction row: MSG91 SMS/API/template/DLT documentation, MSG91 delivery report or callback documentation, Exotel SMS API documentation, Exotel API Settings documentation, and Exotel SMS status callback documentation. If a vendor support ticket supplies the value, store the ticket id and approver in the extraction row.

Watch out

Do not paste Authkey, API Key, API Token, callback token, or raw callback payload into launch notes, mobile screens, support chat, or screenshots.
Do not send production SMS from a sender/header that is not approved for the gym. Provider acceptance of the API request is not the same as DLT/template delivery approval.
Do not edit an approved DLT body casually inside SquareOS. A small text or variable-order mismatch can cause provider rejection or delivery failure.
Do not treat fake-mode provider ids or queued DeliveryAttempt rows as proof of live SMS delivery. Production proof requires a real provider message id and callback/status reconciliation.
Do not bypass opt-out, consent, or quiet-hour policy because a message is short. Backend suppression is part of the SMS certification evidence.
Do not reuse one MSG91/Exotel credential across tenants unless the provider contract, sender ownership, DLT entity, and SquareOS tenant mapping explicitly allow it.

Use the left menu to open related pages in Start Here.
Use Ask Docs for questions that are already covered in this public documentation.