Testing SMS OTP Flows in Staging: QA Checklist

Introduction

If you need to test an SMS OTP flow before release, this is the checklist we would run in staging. Our guide Temporary Numbers for QA SMS OTP covers why to use temporary numbers instead of personal SIMs. This post is the test plan itself: what to check, the expected result for each item, and how to run real-number checks.

Quick Answer

• Use sandbox or mocked SMS for CI; save real numbers for end-to-end release checks.
• Cover happy path, resend, expiry, wrong code and rate limits.
• Store numbers in E.164 and test messy input.
• Check how your app treats VoIP/virtual numbers.
• Never log full OTP codes.

Before You Start: Test Numbers vs Real Numbers

Use your SMS provider's sandbox or test numbers (or a mocked SMS sender) for unit and CI tests. They are fast, repeatable and cost nothing per message. However, keep a small set of real end-to-end runs on actual inbound numbers before release. Only real delivery catches carrier filtering, sender ID issues, country routing, and VoIP or number-type rejection. Never point staging at real customers' numbers.

The Checklist

Happy Path

• Request Code: Code is sent to a valid mobile number.
• Receive Code: SMS arrives; note how long it took.
• Enter Code: Correct code is accepted on the first try.
• Verify Success: Application verifies the OTP and grants access.
• Reuse Check: Code cannot be reused after success.

Resend and Throttling

• Resend Button: Disabled until cooldown period is over.
• Code Invalidated: Resend invalidates the previous code.
• Resend Cap: Limit on resends per number/session.
• UI Message: Clear message displayed when throttled.

Expiry

• Code Rejection: Code is rejected after TTL.
• Clear Message: Display 'code expired' message.
• New Code Works: A new code can be requested and used.

Wrong Code

• Generic Error: Application returns a generic error for wrong codes.
• Attempt Counter: Track attempts made.
• Lockout: Lockout after N failures.
• No Hints: No hints provided on which digits were correct.

Rate Limits and Abuse

• Per-Number Limits: Implement limits on OTP requests per number.
• Per-IP Limits: Set limits on requests from the same IP.
• Per-Account Limits: Enforce limits on requests per account.
• Send Endpoint Limits: Protect against SMS pumping/toll fraud.
• CAPTCHA: Implement CAPTCHA if applicable.

Phone Formats

• E.164 Storage: Store phone numbers in E.164 format (+ country code + national number, no leading 0 or spaces).
• Input Testing: Test input variations (spaces, dashes, leading 0, missing +, wrong country selected).
• Country Picker: Ensure country picker defaults correctly.

Number Type Checks

• VoIP Rejection: If blocking VoIP numbers, ensure rejection message is clear.
• Allowed Numbers Deliver: If you allow virtual numbers, confirm the SMS actually arrives. See VoIP vs Real-Route SMS for OTP.

Idempotency and Concurrency

• Double-Click Submit: Only one code sent/charged on double-click.
• Two Tabs: Only the latest code is valid when using two tabs.
• Network Retry: Verify endpoint is safe to retry.

Logging and Privacy

• No Full OTP Logging: Never log full OTP codes or message bodies.
• Masked Numbers: Mask phone numbers (e.g., last 4 digits).
• Request IDs: Keep request IDs for tracing.
• Staging Logs: Follow the same logging rules in staging.

Templates and Delivery

• Message Readability: Ensure message text is readable.
• App Name Present: Include app name in the message.
• Code Copying: Code should be easy to copy.
• Autofill Testing: Test autofill if relevant.
• Delivery Timing: Record time from request to arrival.

Running Real-Number Tests with GetVerifyCode

1. Create an account at getverifycode.com/start.
2. Top up your wallet; current rates are on Pricing. You pay per activation, not a subscription.
3. Pick the country your test needs (e.g. the market you launch in).
4. The number appears in your dashboard immediately. Enter it in your staging sign-up form in E.164 format.
5. Trigger the OTP from your app.
6. Watch for the SMS in the dashboard. You have about 20 minutes to receive the code. See How to Check an OTP Sent to a Virtual Number.
7. If no SMS arrives before the window ends, the unused credit returns to your wallet automatically. Details: SMS Holds, Timeouts, and Credit Returns.

For repeatable, automated runs see SMS Verification API for Developers: Automate OTP Testing; for whether to reuse a number or take a fresh one per run, see Reuse vs Fresh Temporary OTP Numbers.

Country Coverage for International Tests

Testing each launch market with a local number helps catch routing and format bugs. See guides for USA, UK, Canada, Germany, and India. For more options, visit Choose a Country for OTP Numbers.

Troubleshooting Real-Number Runs

• No SMS Arrived: Check E.164, right country, your send logs; resend once after cooldown; see Didn't Receive a Verification Code? 12 Fixes.
• Your App Rejects the Number: Likely a number-type rule; see This Phone Number Can't Be Used for Verification.
• Number Already Used: See Phone Number Already Used, use a fresh number.
• Window Expired: Take a new number; unused credit returns automatically.
• Wrong Country Picked: Cancel and pick again.
• Still Stuck: Open a support ticket from your dashboard.

Lawful Use Only

GetVerifyCode is for lawful QA and privacy. Test only apps you own or are authorized to test. Do not create fake or bulk accounts or use numbers to get around another platform's rules. Rules on virtual numbers differ by country and service, so check local law and each service's terms. See Acceptable Use and Are Temporary Phone Numbers Legal and Allowed?.