Add two-factor authentication over SMS
Two-factor authentication adds something the user has — their phone — to something they know. An SMS code at login, or on a sensitive action like a payment or a password change, is the most widely reachable second factor in India. Two API calls add it.
Where a second factor belongs
The clearest place is login: after the password, send a code and verify it before the session opens. The same pattern works as step-up authentication — let a user browse, but require a fresh code the moment they move money, change a password, or add a payee. You send when the action starts and verify before you let it complete.
SMS is the second factor most Indian users can actually receive: no app to install, no token to carry, just their phone. That reach is why it remains the default for consumer 2FA, even where an authenticator app is offered alongside it for users who want one.
The security of SMS 2FA rests on the controls around the code, not the channel. Short time-to-live, a cap on verify attempts, and a limit on how many codes a number can request mean a code is hard to brute-force and useless once expired. Because the code never returns to you, it can't leak from your logs.
SMS 2FA isn't immune to SIM-swap or phishing, and high-risk systems should layer it with device signals or an authenticator. For the broad base of consumer accounts in India, though, an SMS code is the factor with the widest reach and the lowest friction, and it's a meaningful step up from a password alone.
What’s included
Code at sign-in
Verify a code after the password before the session opens.
Re-verify sensitive actions
Require a fresh code on payments, payee changes, or resets.
No app required
Works on any phone — the widest-reaching second factor in India.
Rate and attempt caps
Limit codes per number and guesses per code against brute force.
Voice when SMS fails
Read the code out so a failed SMS doesn't lock a user out.
Recorded per attempt
Every send and verify is logged for a security or dispute review.
Frequently asked
Is SMS-based 2FA secure enough?
For the broad base of consumer accounts, yes — it's a real step up from a password alone, and its reach is unmatched in India. Its strength comes from the controls around the code: short expiry, attempt caps, and codes that never reach your logs. High-risk systems should layer it with device signals or an authenticator app.
What about SIM-swap attacks?
SMS 2FA isn't immune to SIM-swap or phishing, which is why it's a factor rather than the whole defence. Pair it with signals you already have — a known device, a usual location, velocity checks — for sensitive actions, and reserve step-up codes for the moments that matter most.
Should I use an authenticator app instead?
Offer it alongside, not instead. TOTP authenticator apps are stronger but assume the user installs and configures one, which many won't. SMS reaches everyone with a phone, so most products use SMS as the default and let security-conscious users add an authenticator.
How is 2FA priced?
Per message on the transactional route, with GST shown separately; a voice fallback is charged as a voice call only when used. Codes that are never sent — a user who passes a risk check and skips 2FA — cost nothing. See the pricing page.