One-time passwords for US users that arrive, with proof they did

No SMS category punishes a late arrival like a one-time password. The code is only valid for minutes, the user is watching the clock, and every failed attempt is another friction point in your funnel: a customer locked out of an account, a transaction abandoned mid-flow, a support ticket about a code that never came.

This is why OTP should be treated as a reliability problem rather than a content problem. The message is four to eight characters; what matters is that it reaches the handset promptly and that you know whether it did. Everything about an OTP deployment, sender registration, receipt monitoring, resend logic and campaign separation, exists to serve that one outcome. Marketing metrics such as open rate and engagement are the wrong scoreboard here; the right metric is verified delivery of a code inside its validity window.

The failure modes are asymmetric too: a late marketing message is an annoyance, a late OTP is a lost session.

OTP traffic to US numbers is application-to-person traffic, and A2P on US networks runs on registered senders. From a 10-digit number, that means 10DLC brand and campaign registration through The Campaign Registry, with the trust score that influences how carriers treat your traffic. From a toll-free number, it means verification before A2P use, and unverified numbers have been blocked for A2P in the US and Canada since January 2024.

Sending OTP from an unregistered number does not fail loudly; it fails silently at the carrier, and the user just sees a code that never arrived. Registration takes time, vetting can complete in hours to days with carrier sync on top, so plan for days rather than hours and register before you switch on the login flow. Our 10DLC page covers the process, and the toll-free page covers the alternative.

Registration also affects reply handling and reporting, so doing it late means rework rather than ticking a box.

An API response is a receipt of acceptance, not a receipt of delivery, and the difference is fatal for OTP. A message can be accepted and then filtered, throttled or lost without any error at submission time. The only honest way to run auth traffic is to monitor delivery receipts and act on them.

WorldText delivers receipts to the callback or receipt URL you configure, and our message state and errors page documents the states and codes your systems will see. Build the flow deliberately: decide what you do when a receipt never arrives, whether you re-issue the code, how long you wait before resending, and how you alert an operator. The systems that handle millions of logins do exactly this, because a login code is the kind of message where silence has a real cost.

Decide the timeout policy in advance: how long to wait, how many resends to allow, and when to alert a human rather than retry.

The classic failure is a marketing opt-out taking auth traffic with it. A customer replies STOP to a promo, their subscription is marked opted out, and their login codes, payment confirmations and password resets stop arriving too. The customer is no longer opted out of authentication; they are opted out of your product.

The fix is separation: register distinct campaigns for transactional and marketing traffic, keep consent and auth triggers in separate data structures, and treat STOP as applying to promotional messages while the codes a customer's own actions imply keep flowing. This is practice rather than regulation, and it protects your users more than any single filter rule. Our transactional SMS page and transactional vs marketing guide cover the distinction in more depth.

Even where separate campaigns are not available, separate categories in your own systems, keep consent and auth triggers apart, and let that structure drive sending decisions. The distinction is information, not ceremony.

OTP sending is not a place for a campaign builder; it is a place for a call your code makes on every login attempt. You need a documented API over HTTPS with per-account credentials, encoding control so codes with special characters survive intact, delivery receipts, and an SMPP path if your volume ever outgrows HTTP. You also need a provider that will tell you the truth about US registration rather than sell you sender health as a feature.

WorldText is that infrastructure. US destinations are 8 credits per single-part message, multipart messages are charged as multiple messages, and the same integration covers your other markets. Teams in SaaS and technology and financial services use this pattern for login, MFA and password reset flows precisely because the messages do not tolerate guesswork.

The same integration covers every market on the account, so auth flows built for the US are reusable rather than one-off.