MS one-time codes can fill themselves in if the message is formatted for the platform. On Android, the SMS Retriever API reads a message that is no longer than 140 bytes, contains the code and includes an 11-character hash that identifies your app. On iOS and in Safari, mark the input with autocomplete="one-time-code" (textContentType oneTimeCode in native apps) and the keyboard suggests the code. On the web, the WebOTP API reads a message whose last line is @your-domain #code. One template can satisfy all three.
Key takeaways
- Autofill removes the app switch that loses users between receiving and typing a code.
- Android SMS Retriever: message of at most 140 bytes, containing the code and your 11-character app hash; no SMS permission needed.
- Android SMS User Consent: no hash; the message must contain a 4–10 character alphanumeric code with at least one number; the user taps to allow.
- iOS and Safari: autocomplete="one-time-code" on the input; the domain-bound last line enables Safari's suggestion.
- WebOTP: last line @domain #code, no scheme, port or path; supported in Chrome on Android and desktop.
Why does OTP autofill matter?
Every step between "code sent" and "code entered" loses users: switching to the messages app, memorising six digits, switching back. Autofill turns that into a tap. It also cuts typing errors and, with domain-bound codes, makes it harder to trick a user into entering a code on a look-alike site. It does not fix delivery: the code still has to arrive quickly, so pair autofill with a fast route and fallback. See OTP delivery best practices.
How does the Android SMS Retriever API work?
The SMS Retriever API lets your Android app receive the verification message without asking for SMS read permission. Google's documentation sets three rules for the message:
- be no longer than 140 bytes;
- contain the one-time code that the app sends back to your server;
- include an 11-character hash string that identifies your app.
The hash is computed from your app's package name and its signing certificate: append the package name to the certificate's hex form, take the SHA-256, base64-encode it and keep the first 11 characters. Debug and release builds are usually signed with different keys, so they have different hashes. Your server adds the right hash when it builds the message.
What is the SMS User Consent API?
When you cannot put an app hash in the message, for example because the template is shared with other channels, Android's SMS User Consent API shows the user a prompt to let your app read one message. According to Google, the message must contain a 4–10 character alphanumeric string with at least one number, and, if you specified a sender, come from that sender. The API listens for about five minutes after you start it and then times out.
How does OTP autofill work on iOS?
iOS offers security-code autofill from the keyboard. In a native app, set the text field's textContentType to oneTimeCode; on a web page, add autocomplete="one-time-code" to the input. When a matching SMS arrives, the code appears above the keyboard and the user taps it. Safari does not implement the WebOTP JavaScript API, but Chrome's WebOTP documentation notes that with the autocomplete annotation the default keyboard suggests the code if the SMS follows the domain-bound format below (iOS 14 and macOS Big Sur or later).
What is the WebOTP message format?
The WebOTP API lets a web page read the code with navigator.credentials.get({ otp: { transport: ['sms'] } }). The SMS must start with human-readable text and end with a last line in this form:
Your BroadNet code is 482913. @www.example.com #482913- The last line starts with @ and the domain of the page that asks for the code.
- A single space, then # and the code.
- No scheme, port or path in the domain, and no spaces inside it.
- The human-readable part should contain the code as well, for people who read the message.
Always keep autocomplete="one-time-code" on the input as well, so browsers without WebOTP still offer the code.
Can one SMS template work on every platform?
Yes, if it stays within the Android byte limit and the lines are in the right order. A combined template:
Your BroadNet code is 482913. Do not share it.FA+9qCX9VSu @www.example.com #482913| Platform | What reads the code | What the message needs |
|---|---|---|
| Android app | SMS Retriever API | The code and your 11-character app hash; at most 140 bytes |
| Android app (no hash) | SMS User Consent API | A 4–10 character alphanumeric code with at least one number |
| iOS app | Security-code autofill (oneTimeCode) | A recognisable code; domain-bound line recommended |
| Safari (iOS, macOS) | autocomplete="one-time-code" | Last line @domain #code |
| Chrome (Android, desktop) | WebOTP API | Last line @domain #code |
The hash shown is a placeholder: use your own app's value. Keep the template in the GSM-7 character set so it stays one segment; an emoji or accented letter switches the whole message to Unicode, which halves the room and can break the 140-byte budget. See SMS encoding and segmentation.
How do you send these messages with BroadNet?
Build the message on your server and send it through the OTP API or the SMS API; newlines are part of the message text. BroadNet's OTP product falls back across SMS, WhatsApp, voice and Flash Call when a code does not arrive, and MyOTP.App sends codes by SMS, WhatsApp or Telegram from one account. For the whole flow, read how to build an OTP flow and our multichannel OTP verification guide.
Frequently asked questions
Why is my Android app not reading the OTP SMS?
Usually the app hash in the message does not match the build (debug and release keys differ), the message is longer than 140 bytes, or the listener started after the message arrived.
Do I need SMS permission to autofill codes on Android?
No. The SMS Retriever API and the SMS User Consent API both work without SMS read permission.
How do I enable OTP autofill on iOS?
Set textContentType to oneTimeCode in a native app, or add autocomplete="one-time-code" to the input on a web page.
What is the WebOTP SMS format?
Human-readable text first, then a last line of @ followed by your domain, a space, # and the code, for example @www.example.com #482913.
Does WebOTP work in Safari?
Safari does not support the WebOTP JavaScript API, but with autocomplete="one-time-code" its keyboard suggests codes from messages in the domain-bound format.
Can I use one template for Android, iOS and web?
Yes: the code in the text, the app hash on its own line, and the domain-bound line last, all within 140 bytes.
Platform rules read on 28 September 2026 in Google's SMS Retriever and SMS User Consent documentation (developers.google.com) and Chrome's WebOTP documentation (developer.chrome.com). See our editorial standards.