Auto-read OTP on Android with SMS Retriever
The biggest drop-off in a verification is the user switching apps to read a code and typing it back. Auto-read removes that step on Android: the app reads the code from the incoming SMS and fills it in, with no SMS permission and nothing for the user to do.
How auto-read works
Android's SMS Retriever API lets an app receive a single, specifically-formatted SMS without holding the SMS permission. Your app starts listening, the code arrives, and the framework hands just that message to your app, which fills the field. The user never leaves your screen, and you never ask for a permission that worries them.
Two things make it work: your app's hash string, which ties the message to your app, and a message format the API recognises. You pass the hash in the send request and we format the SMS to match, so the code that goes out is the one the framework will surface to your app.
It sits on top of the normal flow rather than replacing it. The same send returns a verification_id, the same verify confirms the code, and auto-read is purely the convenience of not making the user type. If a user is on an older device or dismisses the prompt, they read the SMS and enter the code as usual.
iOS handles this differently: there's no SMS Retriever, but the keyboard offers the code from a well-formatted SMS as an AutoFill suggestion above it, which gets most of the way there. On web, the WebOTP API does something similar in supported browsers. The send stays the same across all three.
What’s included
No SMS access needed
SMS Retriever delivers just your code without the SMS permission.
Tied to your app
Your hash in the request; we format the message to match.
Nothing to type
The code fills itself, removing the most common drop-off point.
On top of send/verify
The verification_id and verify call are unchanged.
Manual entry still works
Older devices and dismissed prompts fall back to typing.
iOS AutoFill, WebOTP
Keyboard AutoFill on iOS and WebOTP on supported browsers.
Frequently asked
Does auto-read need the SMS permission?
No. That's the point of the SMS Retriever API — it delivers only your specifically-formatted message to your app, without the broad SMS read permission that makes users hesitate. You include your app hash in the send request and we format the message so the framework recognises it.
What do I need to send for it to work?
Your app's hash string and a message formatted the way the SMS Retriever API expects. You pass the hash in the request; we generate the message to match it. The DLT-registered template has to accommodate the format, which we set up with you.
What happens on iOS and web?
iOS has no SMS Retriever, but a well-formatted code is offered as a keyboard AutoFill suggestion above the keyboard, so the user taps once. On web, the WebOTP API fills the field in supported browsers. Where neither applies, the user reads the SMS and types the code, and your verify call is identical.
Does auto-read change the verification itself?
No. It's a convenience layer on the normal send-and-verify flow. The same send returns a verification_id, the same verify confirms the code, and the expiry and attempt caps are unchanged. Auto-read just removes the typing step where the platform supports it.