OTP SMS for logins, sign-ups and payments
Send one-time passwords from your app or website with a single API call. MsgClub sends OTPs on priority routes, switches across 4+ operator routes if one slows down, and reports the delivery status of every code.
- Delivered 24x7, including DND
- Failover and smart retry
- DLT-approved OTP templates
- Delivery report for every code
What is OTP SMS?
OTP SMS is a text message that carries a one-time password, usually 4 to 8 digits, used to verify a phone number, a login or a payment. In India it is sent from a registered 6-letter header using a DLT-approved template, and it is delivered around the clock, including to numbers on the DND list.
Updated
How does OTP SMS work?
Your system creates and checks the code. MsgClub delivers it and tells you what happened.
What keeps OTP delivery fast and reliable?
A late OTP is a lost login or an abandoned payment. These are the parts of the platform that work on every code.
Priority routes
OTP traffic goes on transactional and service routes kept separate from bulk promotional campaigns, so a large sale campaign does not hold up your login codes.
Failover across 4+ operator routes
Multi-operator routing moves traffic to another route when one is slow or failing, without any change on your side.
Smart retry
Attempts that fail for temporary reasons are retried automatically, while permanent failures such as invalid numbers are reported at once.
Real-time delivery reports
See submitted, delivered and failed status for each code with the time and failure reason, in the panel or by webhook.
Encrypted platform
API requests travel over HTTPS, and each account uses its own authentication key that you can keep on your server.
DLT checks before sending
Your header and template IDs are stored in the account, so each OTP is matched to the right registration before it reaches the operator.
How should you write an OTP SMS template?
Under DLT, the text you send must match a registered template word for word, apart from the variable parts.
- Register it under service implicit (or transactional, for banks), never promotional.
- Mark the code and the validity as variables with
{#var#}. Keep the rest fixed. - Name your brand and the purpose: login, sign-up, payment or address change.
- Add a warning not to share the code.
- Keep it in one SMS part: 160 characters in English, 70 in Unicode.
- Leave out links in OTP messages. Any URL in any template must be whitelisted on the DLT platform.
Read the DLT registration guide for the full template process.
{#var#} is your OTP to log in to Shubh Finance.
Valid for {#var#} minutes. Do not share it
with anyone. -Shubh Finance482913 is your OTP to log in to Shubh Finance.
Valid for 5 minutes. Do not share it
with anyone. -Shubh FinanceSample wording. Your operator's DLT platform decides the final approval.
What are the best practices for OTP security?
SMS delivers the code; your application decides how safe the flow is. These rules are worth building in from day one.
| Practice | Recommended setting | Why |
|---|---|---|
| Code length | 6 digits | Hard to guess, easy to type and autofill |
| Expiry | 5 to 10 minutes; one active code at a time | Limits the window for misuse |
| Attempts | 3 to 5 wrong entries, then a new code | Stops brute-force guessing |
| Resend | Allow after 30 to 60 seconds, with a daily cap per number | Prevents SMS pumping and cost abuse |
| Links | No links in OTP messages | Customers learn that OTP SMS never ask them to click |
| Storage | Store a hash of the code, never the code in logs | Protects codes if logs leak |
What if a customer does not receive the OTP?
Give customers a second way to get the code. Because every MsgClub channel has an API, your app can offer alternatives when the SMS delivery report says failed, or when the customer taps "Resend".
- Voice OTP: a call that reads the code aloud, useful for landlines and customers who struggle with SMS. See voice calls.
- WhatsApp authentication template: the code in WhatsApp with a copy button. See WhatsApp Business API.
- Resend by SMS: after a short wait, through a different route.
SMS OTP can be combined with these channels; the switch is a rule you build in your application using the delivery webhook, not an automatic MsgClub fallback.
- SMS OTP sentYour system receives
message.sent. - Delivery fails or customer taps "Resend"Your system receives
message.failedor a resend request. - Your app offers another channel"Get the code on a call" or "Get the code on WhatsApp", sent through the same MsgClub account.
OTP SMS key facts
- DLT category
- Service implicit, or transactional for banks
- Delivery hours
- 24x7, including DND numbers
- Sender ID
- 6-letter registered header
- Routing
- 4+ operator routes with failover and smart retry
- Integration
- REST API, SMPP, webhooks
- Pricing
- Per SMS part; see pricing
Related: transactional SMS · SMS API · API and webhooks · contact sales
Frequently asked questions
How fast is OTP SMS delivered?
Most OTP SMS on a healthy route reach the phone within seconds, but no provider can guarantee a fixed time because the final hop depends on the customer's operator and network. MsgClub reduces delays with priority routes, failover across 4+ operator routes and smart retry, and shows the delivery time of every OTP in the report.
Can OTP SMS be delivered to DND numbers?
Yes. OTPs are sent under the transactional or service implicit category, which TRAI allows to reach numbers registered on the Do Not Disturb list at any hour. The message must still use a registered header and match an approved DLT template, or the operator will block it.
Do I need a separate DLT template for OTP?
Yes. Register a template for each OTP message you send, such as login, sign-up or payment confirmation, with the code and any other changing part marked as a variable. The template should name your brand and must be registered under the service implicit or transactional category, not promotional.
How long should an OTP be valid?
Most businesses keep OTPs valid for 5 to 10 minutes and allow only one active code per request. Shorter validity limits misuse if a code is seen by someone else, while too short a window frustrates customers on weak networks. State the validity in the message so the customer knows how long they have.
Why is my OTP SMS not received, and what can you do?
Common causes are a template or header mismatch on DLT, a switched-off or out-of-coverage phone, a full inbox or an operator delay. MsgClub retries on another of its 4+ operator routes, and the delivery report or webhook tells your system, so your app can offer a resend, a voice OTP call or a WhatsApp authentication message.
Can I send OTP from my app or website?
Yes. Your backend generates the code and calls the MsgClub SMS API with the mobile number, your header and the message text that matches your OTP template. The API returns a request status at once, and the delivery report follows by webhook or in the panel.
How much does OTP SMS cost in India?
OTP SMS is charged per message on the transactional (service implicit) route, and the rate depends on your monthly volume and the number of SMS parts. Keep OTPs to one 160-character part to avoid paying twice. MsgClub shares a written quote for your volume, which states whether any operator DLT scrubbing charge is included or added.
Related products
Use them together from the same MsgClub account, with one API and shared reports.
Start sending in minutes
Create a free account to test the panel and API, or talk to our team about volumes, DLT setup and CRM integration.