OTP SMS for verification and two-factor authentication
Verify phone numbers, secure logins and confirm payments with one-time passwords delivered by SMS. Your application generates the code and sends it through the DARSMS SMS API in a single HTTPS request.
Overview
SMS one-time passwords work on every mobile phone, which makes them the most widely usable second factor for Tanzanian users. They are commonly used for sign-up phone verification, login from a new device, password resets and payment confirmation.
With DARSMS, your backend generates a random code, stores it with a short expiry, and sends it to the user with the send endpoint. The code is never generated or stored by DARSMS, so you stay in full control of verification logic.
Common uses
- Phone number verification at sign-up.
- Login verification and two-factor authentication.
- Password reset codes.
- Payment and withdrawal confirmation.
- Device or SIM change verification.
- Delivery and pickup confirmation codes.
How it works with DARSMS
- 01
Generate the code
Your server creates a random 4 to 6 digit code and stores it with an expiry time, typically 5 to 10 minutes.
- 02
Send it by API
Call the DARSMS send endpoint with your API key, Sender ID, the user's number and a short message containing the code.
- 03
Verify the input
When the user enters the code, compare it with the stored value, check it has not expired, and then invalidate it.
Example messages
Your Pesa App login code is 482913. It expires in 5 minutes. Do not share this code with anyone, including our staff.
117 characters
Use 7314 to verify your phone number on ShopTZ. If you did not request this, ignore this message.
97 characters
Best practices
- Put the code near the start of the message and keep it short.
- Warn users never to share the code, including with your own staff.
- Set a short expiry and limit the number of attempts per code.
- Rate-limit OTP requests per phone number and per IP address to prevent abuse.
- Use a recognisable Sender ID so users trust the code is genuinely from you.
Frequently asked questions
Does DARSMS generate the OTP code?
No. Your application generates and verifies the code; DARSMS delivers the SMS. This keeps verification logic and secrets inside your own system.
How fast are OTP messages delivered?
Messages are queued and sent to the network within seconds of your API request. Final delivery depends on the recipient's network and whether their phone is on and in coverage.
Can I test OTP sending before buying credits?
Yes. New accounts receive 5 free SMS credits, enough to test your integration end to end with the default sender.
Related pages
Ready to get started?
Create a free account with 5 SMS credits to test, then buy credits with mobile money as you grow.