Make OTPs fast, secure and easy to use: template format, expiry, retries, auto-read, rate limits and fallback channels.
An OTP that arrives late is a lost signup or a failed payment. A badly designed one is a security hole. These practices keep your OTP flow fast for users and hard for attackers.
Write a clear, compliant template
- Put the code first: "482913 is your TextNSMS login OTP." Users and autofill find it faster.
- Say what it is for and how long it is valid.
- Add "Do not share this code with anyone."
- No links and no promotion inside OTP templates.
- Register it as a transactional template on DLT so it is delivered 24×7.
Set sensible security rules
- Use 6-digit numeric codes generated by a secure random function.
- Expire codes after 5–10 minutes and after one successful use.
- Limit attempts (for example 5 wrong tries) and lock or slow down after that.
- Rate-limit sends per number and per IP to stop SMS-pumping fraud, where bots trigger thousands of OTPs to premium numbers.
- Never log full OTPs in plain text.
Make it easy to use
- Android: support the SMS Retriever API so the app can read the code without SMS permissions.
- iOS and web: use the one-time-code autocomplete attribute so the keyboard suggests the code.
- Show a resend timer (30–60 seconds) instead of letting users tap resend repeatedly.
Plan for delivery failures
Even good routes have occasional delays. Offer a fallback after the resend timer: a voice call that reads out the code, or an authentication template on WhatsApp. Track delivery time per operator so you notice problems early.
Monitor the right numbers
- Delivery rate and median delivery time
- Verification rate (codes entered ÷ codes sent)
- Sudden spikes in sends from one country, IP or number range
OTP with TextNSMS
The TextNSMS messaging API sends OTP SMS on transactional routes with delivery webhooks, so your app knows within seconds whether a code was delivered. Also see Bulk SMS.
Frequently asked questions
How long should an OTP be valid?
Five to ten minutes is common. Expire it immediately after one successful use.
What is SMS pumping fraud?
Bots trigger large numbers of OTP sends to numbers controlled by fraudsters, who earn from the traffic. Rate limits per number and IP, and monitoring for unusual spikes, stop it.
Related service
Enterprise API with TextNSMS
Prepaid wallet, pay per message, DLT-compliant routes. Serving Delhi, Noida, Gurgaon and all of India.