# Sending OTP and verification codes that arrive

> Message format, validity, retries, fallbacks and rate limiting for one-time codes, with the API settings that matter.

Updated 2026-08-26. Level: Advanced. By SMSMeteor.

## Key takeaways

- Brand first, code second, no links.
- Set validity to the code's lifetime, not 48 hours.
- Flag the traffic transactional to bypass quiet hours.
- Rate-limit the endpoint per number, IP and account.

## The message

Brand first, code second, nothing else that matters: ACME: your code is 493 201. It expires in 10 minutes. Keep it in one GSM-7 segment. Do not include links; operators filter codes with links more than any other pattern. Put the code early so it shows in the notification preview.

## API settings

Flag the traffic transactional with `"window": { "quiet_hours": "bypass" }` so it leaves at any hour. Set `validity` to the lifetime of the code, 10 minutes rather than the default 48 hours: a code delivered after it expired is a support ticket. Send an `Idempotency-Key` built from the user and the attempt number, so a retry from your side never sends two codes.

## Resend logic

Let the user ask for a new code after 30 seconds, then 60, then 120. Invalidate the previous code when you issue a new one. If the webhook reports `message.failed` with an unknown-number reason, tell the user to check the number instead of offering another resend.

## Protect the endpoint

A code endpoint without limits is a way to spend your balance. Limit per number, per IP and per account; require a solved challenge after the second request; refuse destinations you do not serve. The API rejects unsupported prefixes for free, but a flood to valid numbers is billed.

## What to measure

Conversion from code sent to code entered, per destination. It is a better delivery metric than any receipt, because it includes the handset, the notification and the user. A destination that converts ten points below the others deserves a look at its sender rule.

---
Source: https://smsmeteor.com/guides/otp-and-verification-codes (HTML). Generated by SMSMeteor from the same data as the page. Summary of the whole site: https://smsmeteor.com/llms.txt