Guide

How to send OTP by SMS

Send 2FA verification codes by SMS in minutes with an official SDK or the REST API.

An OTP is a one-time code that confirms a user’s identity. Generate it in your backend, send it by SMS, and validate the submitted value. SMSGo handles delivery through Brazilian carriers; the setup takes about 5 minutes.

  1. 1Create an account and get your SMSGo-keyCreate an account, receive 3 free SMS with no card, and copy the key under Account → API.
  2. 2Install an SDKUse npm i @orynlabs/smsgo, pip install smsgo, or call the REST API with cURL.
  3. 3Generate a random codeGenerate a random 6-digit number in your backend.
  4. 4Send the code by SMSCall send or POST /v1/sms/send/single with an international phone number, code, expiry and the Token/OTP type (sms_type_id) — the type is what activates the immediate-delivery route.
  5. 5Store and verify the codeStore it with an expiry tied to the user, compare the submitted value, limit attempts, and invalidate it after use.

Example code

import { SMSGo } from '@orynlabs/smsgo'

const smsgo = new SMSGo({ apiKey: process.env.SMSGO_KEY })

// 1. generate a 6-digit code
const code = String(Math.floor(100000 + Math.random() * 900000))

// 2. send it
await smsgo.send({
  phone: '+5511999990000',
  message: `Your SMSGo code is ${code}. Valid for 5 minutes.`,
  // type 2 = Token/OTP: immediate-delivery route (ids in GET /v1/sms-types)
  smsTypeId: 2,
})

// 3. store code with a TTL (for example, Redis) and compare it during verification
Best practices: keep the message short, link-free, and include your brand and expiry. Test it with the OTP SMS validator.

Frequently asked questions

How do I generate an OTP code?
Generate a random 6-digit number in your backend. You control generation, expiry, and verification; avoid predictable sequences.
What is the ideal expiry?
Five to ten minutes. State the expiry in the message.
The SMS is taking too long to arrive. What should I check?
Make sure the send passes the Token/OTP type (sms_type_id). Without it, the message goes through the slower default marketing route.
How do I verify it?
Store it with an expiry, compare the submitted value, invalidate it after use, and limit attempts.
How much does it cost?
From R$0.07/SMS, prepaid, with no monthly fee.