Key Takeaways
- Scenario 200 is SaaS 2FA recovery: inbound YES from the bound owner before backup codes are shown. Not IP-allowlist, archive, or key rotate.
- If anyone on the thread can YES, you will hand recovery codes to a SIM-swap.
- Do not SMS the backup codes, the TOTP seed, or the password. Workspace name and a short confirm token.
- Login OTP stays on another device from this recovery inbox.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free: 1 device / 300 SMS lifetime / 300 contacts. Developer: 25,000 SMS per year.
Android SMS gateway scenario 200 is a B2B workspace whose owner lost the authenticator. Security wants a human YES on the enrolled number before codes appear. Allowlist and archive inboxes are the wrong list.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Two-way inbox · Developer Center. GSMA.
Recovery confirm, not allowlist
Open a 15-minute inbox window. Match YES + recovery token. Timeout pages security — do not auto-unlock on silence.
If silence equals unlock, you will print backup codes for whoever holds a forwarded screenshot.
YES vs login OTP
| Lane | Body | Inbound | Device |
|---|---|---|---|
| 2FA recover | Workspace + token | Owner YES | Ops modem |
| Login OTP | Digits | Auth | Dedicated |
| Backup codes | Dashboard only | None | — |
Caps: 2 / 5 / 15.
Owner number only
Bind at enrollment, not last login. REST: PHP, C#. MCP wraps REST.
Never SMS the codes
Confirm token only. Codes appear once in the dashboard after YES.
Devices and airtime
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free: 300 lifetime. Developer: 25,000 SMS per year. Pricing.
Same-hour unlock
Audit
Log recovery id + inbound MSISDN + decision. Rotate keys. Not a CodeCanyon 2FA pack.
Inbox or support
If you cannot bind an enrolled number, recover in a signed support ticket. Do not accept YES from the thread.
Checklist
- Owner MSISDN bound at enroll.
- Forwarded YES ignored.
- Silence ≠ unlock.
- No codes in templates.
- Webhook signatures.
Next steps
Send YES from a staff CS number; prove codes stay hidden and the audit fires. Downloads · Docs.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- two-way SMS inboxReplies on your SIM
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS webhook integrationInbound and status events
- SMS auto-reply and STOP keywordsOpt-out and keywords
