OTP best practices by region

One-time passwords are the most time-sensitive SMS you send. These are the practices that matter most across Africa, then what is different in each region.

The simplest path is the Verify API: it generates the code, sends it, limits retries and checks it for you. Everything below also applies if you send codes yourself with POST /api/messages/send.

Everywhere

Keep it to one segment. Use plain GSM-7 characters (no emoji or curly quotes) and stay under 160 characters. A Unicode character halves the limit to 70 and can split the message, which is slower and costs more.

Put the code first and say who it is from. 482913 is your CamJobs code. It expires in 5 minutes. Do not share it. Some phones show only the first line in the notification.

No links in OTP messages. Networks filter OTPs that contain URLs, and users are trained not to trust them.

Use a 6-digit code that expires in 5 to 10 minutes, and allow about 5 attempts before forcing a new code.

Wait before resending. Delivery usually takes seconds but can take up to a minute on a busy network. Offer "Resend" after 30 to 60 seconds and back off after that (for example 30s, 60s, 120s). Each resend is a new paid SMS.

Send in E.164 format (+237677123456). See number format.

Use an Idempotency-Key on each send so a network retry from your server never sends (and bills) the same code twice.

Watch delivery reports. Subscribe to delivery webhooks and track how long codes take per country. A rising failure rate on one network usually means a sender ID problem.

Protect yourself from SMS pumping

Fraudsters trigger OTPs to expensive numbers to earn a share of the fee.

• Enable only the countries you serve. Live sending is off for every country until you enable it, so a bot cannot run up costs in a country you never use.
• Rate-limit OTP requests per phone number, per IP and per account.
• Add a CAPTCHA or device check in front of the "Send code" button.
• Alert on sudden spikes to a single country or number range.

Sender IDs

Leaving sender_id out uses the eSMS Africa default sender for the country, which works with no registration. A branded sender ID builds trust, but on many networks an unregistered alphanumeric sender is replaced or the message is rejected. Register your sender ID in every country you send OTPs to before switching to it (Sender IDs).

West Africa

Live: Nigeria, Ghana, Cote d'Ivoire, Senegal, Benin. Coming soon: the other West African countries.

• Nigeria - register your sender ID with each of the four networks (MTN, Airtel, Glo, 9mobile). Unregistered alphanumeric senders are frequently rejected, so either register or use the default sender.
• Cote d'Ivoire - pre-registration is mandatory on MTN; unregistered IDs are overwritten.
• Senegal - alphanumeric support is limited on some networks; test with your real sender before launch.
• Ghana - one-time sender ID registration covers MTN, Telecel and AirtelTigo.

Central Africa

Live: Cameroon. Coming soon: the other Central African countries.

• Cameroon - 9 digits after +237. OTP works on MTN, Orange and Nexttel. MTN requires alphanumeric sender IDs to be pre-registered; the default sender works without it. See Cameroon.

East Africa and the Indian Ocean

Live: Uganda, Kenya, Tanzania, Ethiopia, Burundi, Madagascar. Coming soon: the other countries in the region.

• Uganda - sender IDs are registered per network and pre-registration is enforced on MTN; allow up to about 3 weeks.
• Kenya - each network has its own one-off sender ID setup.
• Tanzania - sender ID registration needs signed authorization documents.
• Ethiopia - sender ID pre-registration is mandatory; without it messages do not pass. Declare the traffic as OTP when registering.

Southern Africa

Live: South Africa, Zambia. Coming soon: the other Southern African countries.

• South Africa - alphanumeric sender IDs are supported on MTN and Vodacom; on other networks the sender may be replaced by a number. Do not rely on the sender name for trust - put your brand in the message text.
• Zambia - alphanumeric sender registration is mandatory with the regulator and each network.

North Africa

All North African countries are coming soon for live sends. You can build and test against them today with a test key. Expect strict sender ID rules when they open (for example, Egypt does not allow Arabic or generic sender IDs).

Checklist

• Message is one GSM-7 segment, code first, no link
• 6-digit code, 5 to 10 minute expiry, about 5 attempts
• Resend after 30 to 60 seconds, with backoff
• Numbers in E.164 format
• Idempotency-Key on every send
• Only the countries you serve are enabled
• Per-number and per-IP rate limits
• Sender ID registered in each country, or the default sender used
• Delivery webhooks monitored per country