# OTP delivery in seconds, with auto-fallback across four channels. - Canonical URL: https://www.broadnet.me/products/otp - Language: en - Last updated: 2026-10-20 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. OTP delivery · multi-channel fallback BroadNet OTP delivers one-time passcodes to 200+ countries, direct to the operator in 86, with a sub-five-second median, automatic fallback across SMS, voice, WhatsApp and email, and HLR pre-validation on every send. [Improve OTP delivery](https://www.broadnet.me/contact?topic=otp-delivery&product=otp) [Request test access](https://www.broadnet.me/signup) ISO 27001 Audit trails ![The BroadNet snow leopard guarding a glowing padlock and key — a one-time code delivered securely](https://www.broadnet.me/marketing/generated/viz-otp.png) BroadNet · instant OTP OTP delivery <3s delivery 200+ countries 99.99% SLA Messages / day 300M+ Messages carried across the network each day Throughput per node 30,000/s Sustained send rate per node, per second Uptime SLA 99.99% Platform availability SLA on the OTP path Direct-route countries 86 Operator-direct routes for authentication traffic The OTP-only path ## One request in, one direct path, and a code on the handset. OTP traffic rides a path tuned for speed, not raw throughput — premium operator-direct binds, aggressive fast-fail timeouts, and multi-channel fallback wired into the same API. 1. 01 · Request POST /sms/sendSms Destination, intent, language. Retries inside the 5-min window return the same code, so duplicate submits never double-send. idempotent 2. 02 · Validate HLR + fraud score Live HLR lookup catches disconnected, ported, and out-of-service MSISDNs. Velocity and IP-reputation score gates pumping attacks. HLR + fraud 3. 03 · Route OTP-only routes Premium direct binds reserved for authentication traffic. Aggressive fast-fail timeout drops slow operator paths instantly. OTP-only binds 4. 04 · Deliver Operator MT Sender ID rotation per destination. If no DLR in window, voice-TTS fallback fires automatically — same API, no re-integration. sender rotation 5. 05 · Verify Verify the code Constant-time comparison defeats timing oracles. On success the verification context is purged from storage immediately. constant-time 6. ← DLR · verify event 01 · Request POST /sms/sendSms Destination, intent, language. Retries inside the 5-min window return the same code, so duplicate submits never double-send. idempotent 02 · Validate HLR + fraud score Live HLR lookup catches disconnected, ported, and out-of-service MSISDNs. Velocity and IP-reputation score gates pumping attacks. HLR + fraud 03 · Route OTP-only routes Premium direct binds reserved for authentication traffic. Aggressive fast-fail timeout drops slow operator paths instantly. OTP-only binds 04 · Deliver Operator MT Sender ID rotation per destination. If no DLR in window, voice-TTS fallback fires automatically — same API, no re-integration. sender rotation 05 · Verify Verify the code Constant-time comparison defeats timing oracles. On success the verification context is purged from storage immediately. constant-time Developers ## Send a one-time passcode in a single request. One HTTPS call to POST /sms/sendSms — a Bearer token, a sender ID, the destination number and the code text. Use messageType TEXT for GSM or UNICODE for an Arabic code, and the response returns the message ID you reconcile against the delivery report. - POST · /sms/sendSms - The message ID comes back in the 200 response - Same routes, same DLRs as A2P SMS [Build a live request](https://www.broadnet.me/tools/api-request-builder) POST · api.broadnet.me/sms/sendSms Example ``` 1curl -X POST https://api.broadnet.me/sms/sendSms \2 -H "Authorization: Bearer $BROADNET_TOKEN" \3 -H "Content-Type: application/json" \4 -d '{5 "senderId": "BroadNet",6 "destinationNumber": "447700900123",7 "message": "Your verification code is 482913",8 "messageType": "TEXT"9 }'10 11# 200 OK → response body is the message ID, e.g. 2603121407537573731 ``` Built into the OTP path ## Six things that happen on every code, automatically. You hit one endpoint. The platform handles validation, routing, escalation, fraud control, and cleanup so your verification flow stays a single line of code. ### Speed-tuned routing OTP traffic is segregated onto premium direct routes optimised for latency, not throughput. Aggressive timeouts drop a slow operator path within seconds rather than waiting for completion. Routing Direct Priority OTP-only Timeout Fast-fail ### Auto-failover SMS → Voice If the SMS leg doesn't return a delivery receipt within your configured window, the platform escalates to a voice call that reads the code aloud — no integration change required. Trigger On timeout Voice TTS 4 Bill Per delivery ### Sender ID rotation Per-country sender ID pools rotate automatically to avoid operator throttling and grey-route blacklisting. Registered alphanumerics are prioritised where regulation permits. Pools Per country Rotation Adaptive Coverage 200+ ### Number validation (HLR) Inline Home Location Register lookups filter disconnected, ported, and out-of-service numbers before the OTP is dispatched. Invalid destinations return an immediate API error instead of billing waste. Cache 30 day Operator connections 1,000+ Latency Inline ### Fraud-scored delivery Every request is scored against velocity, geography, IP reputation and historical patterns. Premium-rate toll-fraud destinations and signup-pumping bursts are blocked before they touch the network. Rules Per account Velocity Configurable Geo Allow/deny ### Auto-cleanup Codes self-expire and the verification context is purged from storage on use or timeout. Nothing personal lingers in logs longer than the audit window your compliance team set. TTL 1–60 min Attempts Capped Retention Configurable How an OTP travels ## Four steps, one direct path. operator-direct · end-to-end 01 ### Request POST /sms/sendSms with the destination number and the code in the message text. Number validation can run first via /sms/lookup. Inline 02 ### Route Fraud score, country policy and live route quality pick the optimal direct operator path. Adaptive 03 ### Deliver Code is dispatched on the chosen sender ID. Carrier DLR streamed back over the same connection. Direct 04 ### Verify User enters the code; your app confirms in constant time and purges the context. instant request route deliver verified Pre-built verify flows ## Need pre-built verify flows? See MyOTP.App. Drop-in verification widgets for web and mobile, a self-service dashboard, per-app code rules, and a free tier — built on the same OTP delivery path described on this page. [See MyOTP.App](https://www.broadnet.me/products/myotp) Verify your number Code sent to +971 50 ••• 4567 4 8 2 9 1 2 Powered by MyOTP.App Customer stories ## Three teams that shipped authentication without drama. Leading UAE bank Banking · GCC AE **Challenge** OTP delivery was one of the noisiest alerts in the operations channel and a top driver of identity support tickets. **Approach** Traffic moved to dedicated OTP-only routes with sender-ID hygiene managed by BroadNet's regulatory team. Digital identity director (reference under NDA) South Asian mobile-money platform Mobile money · South Asia BD **Challenge** A regional SMPP outage on a peak weekend threatened to break signup flows for a large user base. **Approach** Voice fallback was pre-configured, so when SMS DLRs stopped landing the platform auto-routed every code as a localized TTS call. Identity engineering manager (reference under NDA) West African mobile-money platform Mobile money · West Africa GH NG **Challenge** A premium-rate OTP pumping attack was inflating messaging spend against signup flows. **Approach** A fraud-score gate evaluated MSISDN velocity, source IP and destination-prefix risk before any send completed. Platform lead (reference under NDA) The network behind every code ## Carrier-grade reach behind your OTP. The direct operator network your authentication traffic inherits as a BroadNet customer — the same interconnects that have carried messaging for Google, Meta, and Uber since 2003. Reach 200+ countries Reach for authentication traffic worldwide, direct to the operator in 86. Network 1,000+ operator connections Direct operator interconnects; a labelled partner route where no direct bind exists. Scale 60,000+ enterprises served Businesses that route messaging through BroadNet. Heritage 2003 operating since Two decades of carrier-grade delivery behind every OTP. Compliance ## Audited for the environments that ship money and identity. Every OTP carries an event trail you can replay on demand. Retention windows and residency are configurable per workspace. ISO 27001 / 27018 Information security & cloud privacy Audit trails Per-event log, 12-month retention GDPR & MENA-resident EU and Gulf data residency options Questions buyers ask ## OTP, answered directly. OTP traffic is segregated onto premium operator-direct routes tuned for speed rather than raw throughput, so codes typically arrive before the user can reach for the resend button — fastest on direct MENA routes, with the global network close behind. If an SMS times out, voice fallback fires automatically, usually faster than the user retries. No. You enable it once per channel in the dashboard and set the timeout window (default 10s); if the SMS DLR doesn't arrive in time, the voice leg is triggered for the same send. Your POST /sms/sendSms request stays exactly the same. Three layers: velocity caps per MSISDN and per source IP, geo allow/deny lists per account, and a destination-prefix risk score that down-weights known toll-fraud ranges. Premium-rate prefixes in Eastern Europe, Africa, and parts of Asia are blocked by default; you whitelist what you legitimately need. Per-delivery, per-country. UAE and KSA OTP traffic is $0.045–0.06/code on standard tier; voice fallback bills at $0.018/connected call. Sustained 5M+ codes/month qualifies for enterprise tiers in the $0.022–0.035 range. HLR pre-validation is included; it actually saves money by not sending to dead numbers. TTL is configurable from 1 to 60 minutes; default is 5. On verify success, the entire context — code, MSISDN, intent — is purged from hot storage immediately. The audit trail (without the plaintext code) is retained 12 months on standard, 7 years on enterprise. This product is SMS and Voice OTP. For TOTP/HOTP and silent network verification, see /products/myotp — same routing layer underneath, different verification primitives. Most customers run both, with SMS/Voice as the fallback when the device-based methods aren't available. Sender ID pools rotate automatically and our regulatory team re-registers when rules change. The 2024 TDRA OTP-specific sender ID overhaul, for example, was handled in our backend in the grace window — customers didn't need to touch their integration. You'll see a dashboard note when a rotation happens; that's it. The platform carries a 99.99% uptime SLA. OTP traffic runs on premium operator-direct routes across MENA (UAE, KSA, Egypt, Qatar, Bahrain, Kuwait, Oman, Jordan) with global reach beyond. Delivery targets, monitoring and any service credits are set in your commercial agreement, and an SLA report ships with every monthly invoice. Question not here? [Ask our engineering team](https://www.broadnet.me/contact) OTP delivery is one channel of [BroadNet's A2P SMS platform](https://www.broadnet.me/products/a2p-sms). Teams often combine it with [two-way SMS](https://www.broadnet.me/products/two-way-sms) for reply-based verification, or the [WhatsApp Business API](https://www.broadnet.me/products/whatsapp-business-api) for authentication conversations. Comparing vendors? Read our [Best OTP provider](https://www.broadnet.me/compare/best-otp-provider) buyer's guide. Carrier-grade delivery ## Delivered to 200+ countries, direct to the operator in 86. No grey routes: a direct operator bind wherever one is commercially available, otherwise a labelled partner-managed route. One API to every channel, on a network built since 2003. 200+ Countries 1,000+ Operator connections 300M+ Msgs·day [Talk to sales](https://www.broadnet.me/contact) Authentication infrastructure ## Test your verification flow within one business day. One API call, six things handled, operator-direct routing. Talk to an engineer about volumes, country mix, or moving traffic over from your current provider. [Improve OTP delivery](https://www.broadnet.me/contact?topic=otp-delivery&product=otp) [Review OTP fraud exposure](https://www.broadnet.me/contact?topic=otp-fraud&product=otp) $ curl -X POST https://api.broadnet.me/sms/sendSms Try it Cost per completed verification Resends, fallback and fraud change what each sign-in really costs. Model yours. [Open the explorer](https://www.broadnet.me/tools/verification-cost) Further reading [Number Verify and SIM Swap APIs in the Middle East Where the CAMARA network APIs are live, and how to check for a SIM swap before you send an OTP.](https://www.broadnet.me/blog/number-verify-sim-swap-api-middle-east) [Is SMS OTP banned? What the UAE, India and Philippine bank rules actually require in 2026 No, SMS OTP is not banned. What the CBUAE, RBI and BSP rules require of banks in 2026, who is in scope, the deadlines and what replaces SMS codes.](https://www.broadnet.me/blog/sms-otp-bank-regulation-uae-india-philippines-2026) Resources OTP datasheet [Download datasheet· PDF, 100 kB](https://www.broadnet.me/resources/datasheets/broadnet-otp-datasheet.pdf) [Product datasheets](https://www.broadnet.me/resources) ## Related guides & answers Go deeper on the concepts behind this product. - [What is OTP Read](https://www.broadnet.me/answers/what-is-otp) - [How do I build an OTP verification flow Read](https://www.broadnet.me/answers/how-to-build-otp-flow) - [OTP vs 2FA — what's the difference Read](https://www.broadnet.me/answers/otp-vs-2fa) - [What are SMS OTP best practices Read](https://www.broadnet.me/answers/sms-otp-best-practices) - [What is 2FA (two-factor authentication) Read](https://www.broadnet.me/answers/what-is-2fa) - [What is OTP delivery rate Read](https://www.broadnet.me/answers/what-is-otp-delivery-rate)