The message
Brand first, code second, nothing else that matters: ACME: your code is 493 201. It expires in 10 minutes. Keep it in one GSM-7 segment. Do not include links; operators filter codes with links more than any other pattern. Put the code early so it shows in the notification preview.
API settings
Flag the traffic transactional with "window": { "quiet_hours": "bypass" } so it leaves at any hour. Set validity to the lifetime of the code, 10 minutes rather than the default 48 hours: a code delivered after it expired is a support ticket. Send an Idempotency-Key built from the user and the attempt number, so a retry from your side never sends two codes.
Resend logic
Let the user ask for a new code after 30 seconds, then 60, then 120. Invalidate the previous code when you issue a new one. If the webhook reports message.failed with an unknown-number reason, tell the user to check the number instead of offering another resend.
Protect the endpoint
A code endpoint without limits is a way to spend your balance. Limit per number, per IP and per account; require a solved challenge after the second request; refuse destinations you do not serve. The API rejects unsupported prefixes for free, but a flood to valid numbers is billed.
What to measure
Conversion from code sent to code entered, per destination. It is a better delivery metric than any receipt, because it includes the handset, the notification and the user. A destination that converts ten points below the others deserves a look at its sender rule.
Something unclear or out of date? Write to [email protected]; corrections are folded back into the guide and the update date changes.