Key Takeaways
- Laravel OTP through an Android SMS gateway is queued HTTPS/JSON with an idempotency key — not a Laravel SDK and not a blast loop.
- Do not await the radio in the HTTP request. Dispatch, persist the challenge, verify DLR separately.
- Isolate the OTP queue and device pool from promotional jobs.
- Google SMS Retriever runs on the user device. The gateway phone still needs send permission and airtime.
- Canary staff numbers before customer 2FA. Unknown DLR is not success.
- You bring the Android and operator credit. We meter devices and send volume.
OTP is a job, not a Notification facade
Laravel SMS gateway for OTP verification is how you issue a short code through a paired Android: hash the challenge, enqueue HTTPS/JSON, expire it, never log the body. It is not a rewrite of the Laravel SMS gateway hub and not the bulk-send-loop spoke.
If the login request waits on SmsManager, you did not add 2FA — you added a timeout with a SIM attached.
Hub I owns architecture
Drivers, queues, and notifications live on the hub. This in-depth page is OTP failure modes: duplicate codes on retry, promo jobs starving the radio, staff canaries. Live send fields stay in Developer Center. REST samples: PHP HTTPS/JSON— not a Composer SDK.
What Laravel must persist
| Field | Why | Miss |
|---|---|---|
| user_id + purpose | Idempotency / cooldown | New code on every refresh click |
| gateway message id | Join DLR later | Treating HTTP 200 as delivered |
| expires_at | Short TTL | Codes valid until tomorrow |
| hashed code | Verify without logging OTP | Plaintext in Horizon failed-job payload |
Use-case page: OTP and 2FA SMS on Android. Do not mix STOP copy into the template.
SMS Retriever is the other phone
Google SMS Retriever helps the user’s app read the inbound OTP without inbox permission. The gateway Android still sends it. Two devices, two permission stories.
Cost
You bring the Android and operator SMS credit. We meter devices plus platform volume. Failed OTP loops still burn airtime — budget them. Free 1/300/300 is a bad 2FA soak test. Developer is 25,000 SMS/year on 1 device. Starter / Pro / Business uncap platform volume with device caps 2 / 5 / 15. See device and SMS volume pricing.
Checklist
- Hub linked; bulk loop not cloned.
- Send from a queued job, not the controller.
- Idempotency on user + purpose.
- OTP queue isolated from promo.
- No SDK product language.
- Staff canary passed.
- OTP bodies out of logs.
- Developer Center used for live fields.
Next steps
Worker pool design is the queue-workers sibling. Pair a phone in the device setup guide.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- PHP REST send samplesPHP code examples
- device and SMS volume pricingPlans and allowances





