To integrate an OTP SMS API in India, you need three things: a DLT-registered Entity ID and OTP template, an API key from your SMS provider, and backend logic to generate, send and verify the code. This guide walks through all five steps, with working code.
The 5-Step Process
1. Register and get your API key — Sign up for a free SMSGatewayHub account and copy your APIKey from the dashboard's API Settings page.
2. Register your DLT entity and OTP template — Register your business Entity ID and an OTP message template on your telecom operator's DLT portal. Approval typically takes 24–48 hours.
3. Generate and send the OTP — Generate a random numeric code in your backend, then call the SendSMS endpoint with channel=OTP, your EntityId and dlttemplateid.
4. Store a hashed OTP with an expiry — Hash the OTP and store it server-side with a 5–10 minute expiry window — never store or log it in plain text.
5. Verify the code the user enters — Compare the hash of the submitted code against your stored hash, and reject it if the expiry window has passed.
Sending the OTP: Code Example
The OTP channel gets the highest delivery priority and bypasses DND filters, while still requiring a DLT-approved template:
// PHP example
<?php
$apikey = "yourapicode";
$sender = "TESTIN";
$entityId = "your-entity-id";
$templateId = "your-otp-dlt-template-id";
$number = "91989xxxxxxx";
$otp = random_int(100000, 999999);
$text = rawurlencode("Your OTP is $otp. Valid for 5 minutes. Do not share this code with anyone.");
$url = "https://www.smsgatewayhub.com/api/mt/SendSMS"
. "?APIKey=$apikey&senderid=$sender&channel=OTP&DCS=0&flashsms=0"
. "&number=$number&text=$text&route=1"
. "&EntityId=$entityId&dlttemplateid=$templateId";
$response = json_decode(file_get_contents($url), true);
if ($response['ErrorCode'] === '000') {
// store hash($otp) with a 5-minute expiry against this user/session
$hashedOtp = password_hash((string)$otp, PASSWORD_DEFAULT);
// save $hashedOtp + expiry timestamp to your database/cache
} else {
// handle $response['ErrorMessage']
}
?>
Verifying the OTP Securely
<?php
// $submittedOtp = code the user typed in
// $storedHash, $expiresAt = what you saved when sending the OTP
if (time() > $expiresAt) {
// OTP expired — ask user to request a new one
} elseif (password_verify((string)$submittedOtp, $storedHash)) {
// OTP correct — mark session/user as verified
} else {
// OTP incorrect — allow limited retries, then rate-limit
}
?>
Security Best Practices
| Practice | Why it matters |
|---|
| 4–6 digit numeric codes | Easiest for users to enter, works with SMS autofill on Android/iOS |
| 5–10 minute expiry | Limits the window for interception or reuse |
| Rate-limit requests | Prevent abuse — e.g. max 3 OTP requests per number per 10 minutes |
| Hash before storing | Never store or log the OTP in plain text |
| Clear messaging | State the OTP, its purpose, and a "do not share" warning in the SMS text |
✅ SMSGatewayHub is ISO 27001, ISO 9001:2015 and SOC 2 certified — see the Trust Center at smsgatewayhub.com/trust-center for the full security posture behind this API.
FAQ
Is DLT registration required to send OTP SMS in India?
Yes. TRAI mandates DLT registration of your Entity ID, Sender ID and message template for all commercial SMS, including OTPs, sent to Indian mobile numbers.
How long should an OTP be valid for?
5 to 10 minutes is standard — short enough to limit interception risk, long enough for users to check their phone.
Does OTP SMS bypass DND (Do Not Disturb) restrictions?
Yes. OTP and transactional SMS are delivered to DND-registered numbers 24×7, unlike promotional SMS.
Full API reference: for every parameter, response format, and the JSON/XML/Node.js/PHP samples with a live tester, see the complete SMS & OTP API documentation at smsgatewayhub.com/free-sms-gateway-developer-api. Sending from Node.js? See the companion Node.js SMS API guide.
Get your free API key and start sending OTPs
Free signup, no setup fee — DLT-compliant OTP delivery with DND bypass.
🔑 Get Your Free API Key