Building YonoSIM API in the open — Vol. 3

I’ll start with the scoreboard I set for myself, because the whole point of this log is that I don’t get to move the goalposts after the fact.

In Vol. 2 I wrote: “Today that number is 1. One is not a channel. Three would be.” Today, 2026-10-23, that number is 5.

Where that stands, in full:

The last row is the one I care about. Seven weeks ago I had nine partners sitting in a registry, five of whom had never been issued a credential, and a to-do item that said write to some marketplaces. I never wrote to them. The listings happened anyway, and working out why is most of this volume.

The metric I didhit is the one I’d given up on. Vol. 1 said the number that mattered was live-mode API integrations. Vol. 2 retired it as the wrong question. Three days ago a travel agency in Madrid put the API into production, which makes that retired number 1for the first time. I’ll come back to it, including the part where nobody has travelled on one of those orders yet.

The part I got wrong was which side of the funnel I was standing on

Vol. 2 ended with three things I said I’d change. One of them was “write to marketplaces, not just to app developers.” I want to be exact about what happened next, because it is the only genuinely interesting thing in this volume: I never wrote the emails. Not one. I got busy with the consumer site, the way I always do, and the outreach task sat in a list.

And they arrived anyway. Here is the complete ledger since Vol. 2 shipped on 26 August — everyone who turned up unprompted, how they got in, and nothing cherry-picked out:

Eighteen in eight weeks. Zero outbound emails. I’ve named only the companies whose listing is already public; the rest are described by shape, because I set that standard back when I asked permission before naming a partner and I’m not going to quietly drop it now that I have a longer list to brag about.

Read the last column, though, because it is the one I got wrong when I first wrote this section. I had typed those sandbox rows up as people asking me for a key. They weren’t asking. They just took one. The form at /developersmints the key, emails it and credits the account without a human touching it, so for four of the eighteen there was never a conversation to have — I found out they existed by reading my own database.

That gate came down in Vol. 1. I tore out “request early access” in the first week of this log and then spent two volumes reporting the thing it produced, which was zero, zero, and zero again. It stayed zero for six weeks. This is the first volume where I can show you what it bought: five strangers now hold sandbox keys they issued themselves, and not one of them had to wait on me being at a laptop.

What strikes me isn’t the count. It’s that I had been thinking of “partners” as one door, and there are four: comparison sites that list us, mobile network operators asking how our stack is built, travel-app builders who want the API inside their own product, and a visa-help site that found us by reading a guide closely enough to catch an error in it. In Vol. 2 I confessed to filing marketplaces under “affiliate stuff” and missing my own first customer. Seven weeks later I’d made a smaller version of the same mistake: I had one mental slot labelled partner, and four different kinds of business kept arriving into it.

One of those four has changed character since I drafted this section, and it is the one I expected least. Four mobile network operators and MVNOs have now approached us — the first back in August, the most recent two days ago. I am not going to name them, for the same reason I didn’t name the comparison sites before their pages went up: nothing is signed, and a logo on my blog is not a deal.

What I will say is what makes it strange. These are companies that own the radio towers. We are a one-person reseller who buys capacity from aggregators and marks it up, and the entire premise of this log is that I am too small to be interesting to anyone. One of them is now at the paperwork stage — agreement being signed, account setup pending. If it completes, it means buying local network capacity directly in a market where we currently route through a middleman, which is the single biggest lever on both price and the IP-breakout problem further down this post.

I have no idea yet whether it closes. Carrier timelines are measured in quarters and I have been excited about less before.

The one that onboarded itself

On 5 October a partnerships lead wrote in. His group runs four comparison sites — eSIM Advice among them — and his note said, in effect, that YonoSIM was a gap on their list and how should they go about closing it. The honest answer was that there was no “how.” There was me, reading the email eventually.

So I spent an afternoon and shipped a page instead of a reply: /partners/listing. One form. It mints a feed key, hashes it, emails the plain key once to the address you applied from, and switches on your feed endpoints, your /partner/<slug> docs page and your row in our payout ledger. Commission starts at 10% and goes to 15% with volume. You can opt into a discount code for your readers, which we create in Stripe on the spot. There is no setup fee, no minimum, and no call with me.

Before that page existed, every one of those steps was me: read the email, decide, add a slug to a TypeScript file, open a pull request, deploy, generate a secret, set an environment variable, redeploy, write back. A comparison site that found us on a Saturday waited until I noticed. I was the rate limiter on my own distribution, and I’d been the rate limiter for months without once writing it down as a problem.

On 9 October they used it, and the system onboarded them without me. A row appeared in a table. No negotiation, no deploy, no second email from me. Two weeks later their listing went live, and I found out the same way you would have — by looking at their site. The work I did was not onboarding a partner. It was making sure the next twenty don’t need me to.

I want to be precise about the sequence, because the flattering version of this story is that a stranger found a self-serve page and signed up cold, and that is not what happened. They came to me first. The page was my answer to them. The lesson isn’t that self-serve conjures demand out of nothing — it is that when demand does turn up, the thing worth building is the door, not the welcome.

That is the whole lesson of this volume and it cost me one afternoon of work: the bottleneck was never demand, it was me. There are two doors into this company and I built them eleven weeks apart. The developer one has been self-serve since Vol. 1 and has quietly let five people in. The listing one needed me personally until 8 October, and the day after I removed myself, somebody walked through it. Five of the eighteen above landed in weeks when I was heads-down on the consumer site; the ones who arrived at the self-serve door got in anyway, and the ones who arrived at the other one waited. I spent Vol. 2 worrying that nobody wanted the thing. The actual failure mode was that the people who wanted it had to get through me first.

Where they come from doesn’t show up in analytics

I went looking for the channel that produced eighteen inbound approaches, expecting to find a referral path. Here is what the analytics actually say, over the last 60 days:

• LinkedIn sent no orders at all, and well under one visit a day. As a traffic channel it is indistinguishable from nothing — it is a rounding error against search.
• Organic search grew about 16% fortnight over fortnight, with conversions up a little faster still. Real, modest, and almost entirely consumer traffic buying eSIMs.
• Average position in Google improved from 13.1 to 10.6 and click-through from 1.61% to 2.15%, on fewer impressions than the fortnight before. We got more findable while getting shown less.

So neither channel “produced” a partner in any way a dashboard would credit. Every one of those that wrote in arrived as an email, typed by a human, to an address on our site. What the two channels did was make us findable by people who decide thingsrather than by people who buy things — and those are different populations that happen to use the same search box.

The evidence is in the subject lines rather than the referrer header. The visa-help site wrote about a specific exception in a specific paragraph of my Singapore guide — they’d read it properly, and they addressed me by name because the byline is a name. Two comparison sites named the plan structure they wanted to ingest, which is only described on the partner docs page. These are not people who clicked an ad. They’re people who read something and formed a view about whether the company behind it was real.

I want to be careful not to turn that into a tidy law, because nine LinkedIn sessions is not evidence of anything and I’d be inventing a mechanism to flatter a post I enjoyed writing. The honest version is narrower: a channel can be worth keeping while converting nothing, and if you only grade channels by attributed revenue you will switch off the one that was quietly building the reason anyone answers your email. I can’t prove LinkedIn did that. I can prove it sold nothing, and that I’m keeping it.

Somebody scored us, and I couldn’t edit it

Two of the new listings don’t ask for copy. They take a monthly snapshot of our entire catalogue and measure it. This is the first time in this company’s life that a number about us has been published by someone who doesn’t work here, and I had no advance sight of it.

76 out of 100, “Solid.” Pull it apart and it says something more useful than the headline:

• Coverage 100, Plan terms 100, Transparency 100. Full marks on the three things I’ve spent the year arguing matter.
• Price 74, at 35% of the weight — the heaviest component, and our weakest real one.
• User ratings 40, at 25% of the weight, with the note “no ratings found yet.”

That last line is the finding. A quarter of a stranger’s assessment of us is held down not by our prices, our coverage or our terms, but by the fact that 307 people have bought from us and none of them have left a public review anywhere a comparison site can find it. I have been optimising the product and writing guides, and the cheapest remaining point on that scorecard was something I’ve never once asked a customer for. I’m not going to pretend I knew that and was getting to it.

There is a league table underneath the score, and I want to handle it carefully, because I nearly published the wrong number about myself in a post whose entire premise is publishing the right ones. Raoul emailed on 22 October to say we were #8 of 41. When I opened the page to screenshot it for this volume, a day later, we were #10 of 42— same score, same catalogue, nothing changed on our side. A new provider had joined and the daily recalculation had reshuffled the middle.

So the rank is weather and the components are climate. A position that can move two places overnight without you touching anything is not an achievement to put on a slide. The five bars underneath it are, because each one names a specific thing to go and fix. I’m going to keep using their scorecard as a measuring stick precisely because I can’t edit it — and I will quote the components, not the placing, which is the discipline I would have skipped if the number had happened to flatter me that day.

The other site, eSimGuide, ranks us against the rest of the market on price. Read on 23 October: a gigabyte works out at $1.30 on our catalogue against a $1.34 median, and a day at $0.50 against a $0.50 median.

I’m quoting the per-day figure deliberately, because when their page first went up in late September it read $1.40 against a $0.63 median— we were roughly 2.2× the market on day-rate, and it was comfortably the worst number anyone had ever published about us. In the weeks between, we rebuilt how multi-day plans are priced: the old ladder charged a flat rate per day, so a long trip paid the short-trip price fourteen times over. The new one prices each additional day marginally. I did that work for our own reasons before their page existed. The pleasant shock is watching an outside party’s monthly snapshot register the fix without being told about it.

And the number that still stings, from the same page: 5.2% of our plans come out on the internet inside the country you bought them for. 94.8% exit somewhere else — Singapore 39%, the UK 24%, the US 13%, Hong Kong 11%.

I have to own that one properly, because a month before it was published I wrote a post arguing that almost nobody in travel eSIM tells you where your traffic reaches the internet, and that we do. Both halves are still true. We publish the breakout country on every plan page, which is exactly why a third party was able to compute this figure about us and not about most of our competitors. But I had been carrying that disclosure around as though it were a product advantage, and a scorecard is a good way to learn the difference. Telling people the truth about a limitation is not the same as not having the limitation. Disclosure was the easy half and I’d been taking credit for the whole thing.

Everyone who lists us, and what each of them is good at

Five independent sites now publish a YonoSIM page. None of them was paid, none of them was asked, and not one of them let me see the page before it went up. I want to name all five properly, because “comparison site” flattens five quite different pieces of work into one noun.

• eSIMDB— the oldest relationship we have, live since before Vol. 1 and still the one I never mentioned until Vol. 2. They build a page per destination, so we show up on ninety country pages rather than one profile, and they still send buyers every month.
• Find Your eSIM, run by Onne Bakker — the only one who bought a plan anonymously and tested it on the ground in Korea before listing anyone — and the single best-converting referral source we have. His price index is also the thing I check our own pricing against.
• eSimGuide— takes a monthly snapshot of our whole catalogue and ranks it against fifty-odd providers on price per gigabyte, price per day and coverage. They are the reason I know our IP-breakout number, below — which is a different kind of useful from a referral.
• eSIM Rankings, run by Raoul at GSS Analytics in London — recalculates every provider’s score daily from a published methodology, and states plainly on the homepage that it sells zero paid placements. More on their scorecard below. Zero orders so far.
• eSIM Advice— the newest, one of four comparison sites run by the same group. They approached us, then onboarded themselves through the form, and built and published the listing on their own schedule. Eighty-four providers compared, and it has been live for days rather than months.

What strikes me reading those five back is how little overlap there is. One goes deep per country, one tests on the ground, one measures prices monthly, one scores daily, one aggregates at breadth. If I’d written the outreach emails I promised in Vol. 2, I’d have sent all five the same pitch, because I thought they were all the same business.

There was a sixth. A Turkish site listed us in early October and dropped us on 15 October, cutting its line-up from ten providers to five. I asked why, offered the discount code I’d refused them a fortnight earlier, and left their key switched on. No answer yet. I don’t think they owe me one — but it is worth knowing that a listing can leave as quietly as it arrived, and that nobody sends you a notification when it does.

One correction before I go on

I drafted this volume a week ago with a section in it arguing that the consumer side had plateaued. I left the draft alone for eight days, pulled the numbers again before publishing, and found it had grown through the period I’d just described as flat — orders up more than a quarter fortnight over fortnight, and the month running roughly 3× where August finished.

I’m leaving the mistake in rather than quietly swapping the paragraph, because the mechanism behind it is the useful part. I called a plateau while standing in the middle of a single fortnight, and I did it because the shape of the chart matched a story I was already telling. Two weeks has never once been enough data to name a trend in this business, and I have now made that error in a document whose entire purpose is not making it.

The number I stopped tracking is the one that moved

Vol. 1 said the metric was live-mode integrations. Vol. 2 retired it, on the grounds that it was aimed at the wrong segment and was only ever going to print a zero. Here is what that zero did while I wasn’t looking at it.

On 18 October a Madrid travel group took a sandbox key through the form and put five test orders through it the same afternoon. On 19 October they asked for a live key. On 20 October they placed the first live-mode order this company has ever received from someone who doesn’t work here. Thirty-six hours, sandbox to production, and I was not in any of it.

They are 71Asia Tours, the China tour-operating arm of Grupo Unodejulio, an online travel agency founded in Madrid in 2013. They run private tours across China for Spanish- and English-speaking travellers — Beijing, Xi’an, Chengdu, Tibet, Hong Kong — with their own licensed guides. Which is to say: the first company to put this API into production is exactly the kind of company I described on /business fourteen months of work ago, and I had stopped expecting them.

Now the part I have to say in the same breath, because the log is worth nothing if I only report the half that flatters me. Three live orders so far: one cancelled, two auto-refunded unused. Nobody has yet travelled on one. A Slovenia day pass and two Turkey day passes went out, went unused, and our own 30-day rule gave the money back without anyone asking. That is a company wiring itself in and testing the plumbing in production, which is what a careful integrator does. It is not revenue, and I am not going to call it revenue.

And the rest of the board:

• Eleven sandbox keys, six from outside the company. Two travel-app builders, a software studio, two resellers and the Madrid agency. Every one of them inbound, every one self-issued.
• Live-mode integrations: 1.It was 0 in Vol. 1, 0 in Vol. 2, and 0 for the first ten weeks of this API’s life.
• Live orders kept by a traveller: 0. The honest companion to the line above.

Vol. 2 argued the API was sixteen days old and too young to judge, and then quietly stopped grading it. I was wrong about the metric in a way that is worth naming: I retired it because it was embarrassing, and told myself it was because it was mismeasured. Those feel identical from the inside. The tell is that I never replaced it with a better instrument for the same question — I just stopped asking. Ten weeks later it moved on its own, through a door I had left open and stopped watching.

Milestones

Day 193, counting from the first real order on 14 April:

• 4.4× the customers and 4.7× the orders we had on the day Vol. 2 went up — eight weeks ago. September was the record month; October is tracking close behind it.
• 52 destination countries actually bought.This is the honest count — a single-country plan for a single country. Our internal dashboard will tell you 132 if you let it count every country inside a regional bundle, and I’ve stopped letting it.
• 62 countries of origin. That one is the travellers themselves, not where they went.
• The first live-mode API order, on day 190. Ten weeks after the endpoint went up.

What I’m changing

• Ask for reviews. The cheapest point on the only scorecard anyone has published about us is sitting in 280 inboxes. I have never asked once.
• Close the four dead slugs or stop counting them.Vol. 2 found five partners who had never been given a credential. One of them — eSimGuide — came back on its own and is now live. The other four still return a hard error, and that is the correct end state; I’ll stop listing them as anything else.
• Keep publishing the price comparison even when it’s bad. A third party is going to publish it monthly whether or not I do. The only thing I control is whether readers hear it from me first.
• Stop treating outreach as the lever.Eighteen inbound approaches arrived in the seven weeks I spent not doing the outreach I promised. The afternoon I spent removing myself from the onboarding path did more than any email I’d have sent.

Vol. 4’s number

Vol. 2’s metric was a count of live integrations. It was 1, and it is now 5. I’m retiring the count, and I want to be explicit about why, because “I’m changing the metric” is usually the sound of someone about to flatter themselves.

A count rewards collecting logos. The obvious fix is a ratio — published listings over keys issued — and I had written exactly that into this section before I noticed it contradicts the whole volume. I don’t decide who gets a key any more. The form does. So the denominator is now set by strangers I’ve never met, and if the portal works the way I want it to, that ratio falls while the business improves. A number that reads failure when the thing succeeds is a bad number.

So Vol. 4 is graded on the one part still entirely mine — the friction between someone wanting to list us and the page being live:

Days from feed key to live listing.

Today that runs from one day at best to about a fortnight at worst. One partner imported the feed and shipped their page inside twenty-four hours, which is the proof that a fortnight is not a law of nature — it’s my feed being harder to work with than it needs to be. Every day in that gap is someone with our data open in a tab, hitting something I could have fixed in advance: a field that needs explaining, a row count that doesn’t match, a price that has to be reconciled.

I like this one because more partners makes it better, not worse — every new arrival is another measurement of where the feed hurts. I can’t improve it by being choosier, by sending emails, or by signing anybody. I can only improve it by making the thing easier to use when I’m asleep.

And a second one, carried over from Vol. 1 now that it has finally left zero: live API orders a traveller actually used. Today the integration count is 1 and that number is 0 — three live orders, one cancelled, two refunded unused. One is a signature on a contract. The other is somebody getting off a plane in Beijing with data that works, which is the only version of this that means anything.

If you run a comparison site and want the feed, you no longer have to find me or wait for me: yonosim.com/partners/listing issues the key itself. If you’re building something that needs to provision eSIMs, yonosim.com/developers does the same for a sandbox key. Both doors are open at three in the morning, which is the entire point of this volume.

The lesson I’m carrying out of this volume is less flattering than the one in Vol. 2 and took half as long to learn: you don’t scale distribution by reaching more people. You scale it by needing to be present for fewer of them.

— Roc · #YouOnlyNeedOneSIM

Common questions