A one-time password (OTP) by SMS is the most common way to confirm a phone number in Uganda. Done badly, it frustrates users and costs you money through abuse. Done well, it is quick and safe. Here are seven practices to follow.

1. Use a random 5 or 6 digit code

Generate it with a secure random function, not a counter or the time. Never reuse a code.

2. Make it expire quickly

Five to ten minutes is enough. Old codes should stop working as soon as a new one is sent.

3. Limit wrong attempts

After five wrong tries, cancel the code and ask for a new one. This stops guessing.

4. Limit how often a code can be requested

Without limits, bots can make your app send thousands of SMS to other people's numbers and drain your balance. Limit requests per phone number, per network and per day.

5. Write a clear message

Include the app name, the code and a warning: "MyApp code: 482913. Valid 10 minutes. Never share it." Keep it under 160 characters.

6. Store codes safely

Save only a hash of the code, not the code itself, and mark it as used once it works.

7. Do not build all of this yourself if you do not have to

Yoola Verify generates, sends and checks the code for you, including expiry, retry limits and rate limiting, through two API calls: verify-send and verify-check. See the API page for details.

Bonus: respect your users

Only ask for a phone number when you really need it, tell users why, and offer a clear way to try again if the SMS does not arrive.

Create a free account to get your API key and test it today.