Help users with OTPs received through SMS

What is the Web OTP API? #

These days, most people in the world own a mobile device and developers are commonly using phone numbers as an identifier for users of their services.

There are a variety of ways to verify phone numbers, but a randomly generated one-time password (OTP) sent by SMS is one of the most common. Sending this code back to the developer’s server demonstrates control of the phone number.

s idea is already deployed in many scenarios to achieve:

• Phone number as an identifier for the user. When signing up for a new service, some websites ask for a phone number instead of an email address and use it as an account identifier.
• Two step verification. When signing in, a website asks for a one-time code sent via SMS on top of a password or other knowledge factor for extra security.
• Payment confirmation. When a user is making a payment, asking for a one-time code sent via SMS can help verify the person’s intent.

The current process creates friction for users. Finding an OTP within an SMS message, then copying and pasting it to the form is cumbersome, lowering conversion rates in critical user journeys. Easing this has been a long standing request for the web from many of the largest global developers. Android has an API that does exactly this. So does iOS and Safari.

The Web OTP API lets your app receive specially-formatted messages bound to your app’s origin. From this, you can programmatically obtain an OTP from an SMS message and verify a phone number for the user more easily.

Current status #

The table below explains the current status of the Web OTP API.

1. Create explainerComplet

2. Create initial draft of specificationComplete

3. Gather feedback and iterate on designComplete

4. Origin trialComplete

5. LaunchChrome 84

Changes from earlier versions #

Early versions of this API were called SMS Receiver. If you are famillar with that version of the API be aware of the changes made to it. Improvements from SMS Receiver API include:

• The SMS message format is now aligned with WebKit’s.
• The web page only recives an OTP code regardless of whatever else is in the message.
• The browser’s application hash code is no longer required in the message.

#api #capabilities #identity #web otp api