OTP by SMS: the checklist I wish I had before launch day

Disclosure: I work on Packet Exchange. The checklist works whatever provider you pick.

SMS one-time codes look simple: generate six digits, send a text, compare. Then real users arrive.

• Expire codes fast. A few minutes is plenty. Old codes are a gift to anyone guessing.
• Limit attempts per code and per number. Without a cap, a script will walk through every six digit code.
• Limit sends per number and per IP. Otherwise someone uses your signup form to send thousands of paid texts to premium numbers (SMS pumping). This one costs real money.
• Store a hash, not the code. Same reasoning as passwords.
• Make resend wait. A short countdown before resend cuts duplicate sends and support tickets.
• Plan for texts that never arrive. Some countries and carriers filter messages. Offer a voice call fallback that reads the code out.
• Log delivery status, not just "sent". Sent means it left you. Delivered means it reached the phone. Watch the gap between the two per country.
• Keep the message short and branded. "Your Acme code is 482913" beats a paragraph, and carriers trust it more.

Where Packet Exchange fits

Verification, SMS and voice fallback come from one API key, so the code path and the fallback do not live in two dashboards. Free account: https://packetexchange.io/register?utm_source=devto&utm_medium=article&utm_campaign=otp_checklist

Which of these bit you in production?