Standardized SMS verification codes: the service provider asks the operator to send a code, then returns the code entered by the user for the operator to verify.
The operator generates a verification code and sends it to the user's phone by SMS.
The user enters the correct code, and the operator confirms successful verification.
For an incorrect entry, the operator reports an invalid code. It also reports expired codes or too many attempts.
AThe operator generates and stores the code, so the service provider does not need its own SMS gateway.
B and CThe operator checks the code, and the service provider acts on the response code.
One Time Password SMS: How it works
- SendThe service provider sends the phone number and an SMS template, using {{code}} to mark where the verification code goes.
- InputThe user receives the SMS and enters the code in the app.
- ValidateThe service provider sends authenticationId and the code. The operator validates them and returns the result.
One Time Password SMS: API spec
POST /send-code to send; POST /validate-code to validatephoneNumber, message (must include {{code}})authenticationId, code| Responses and error codes | Meaning | Example |
|---|---|---|
| authenticationId | ID for this verification | ea0840f3-… |
| 204 | Verified | — |
| INVALID_OTP | Incorrect verification code | ONE_TIME_PASSWORD_SMS.INVALID_OTP |
| VERIFICATION_EXPIRED | Verification ID expired | ONE_TIME_PASSWORD_SMS.VERIFICATION_EXPIRED |
| VERIFICATION_FAILED | Too many attempts | ONE_TIME_PASSWORD_SMS.VERIFICATION_FAILED |
| MAX_OTP_CODES_EXCEEDED | Too many code requests | ONE_TIME_PASSWORD_SMS.MAX_OTP_CODES_EXCEEDED |
Responses for three scenarios (excerpts)
ea0840f3-3663-4149-bd10-c7c6b8912105ID for this verification; include it when validating the code204Verification successful (no response body)ONE_TIME_PASSWORD_SMS.INVALID_OTPIncorrect verification codeSpec source: CAMARA OTPValidation r3.2 (One Time Password SMS v1.1.1)
One Time Password SMS: GSMA use cases
Online password reset using SMS OTP
Problem to solveProtects the password reset process.
One Time Password SMS's roleSends a short-lived verification code to the phone number linked to the account, then checks it to confirm that the requester has the corresponding phone.
GSMA source ↗GSMA case studies (2)
Sources: GSMA Open Gateway Use Case Library and API Descriptions (accessed 2026-10-14). Descriptions are summaries.