Key Takeaways
- Make (Integromat) OTP through an Android SMS gateway is an HTTP module POSTing JSON. We do not ship a Make app/plugin.
- The Android phone still sends GSM. A green scenario is not an inbox.
- Idempotency on user + challenge. Make retries will double-text without it.
- Staff canary. Isolate OTP deviceIds. Do not point a scenario at a customer list to “test filters.”
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free’s 300 SMS lifetime vanishes in a looped scenario.
Make is the conductor, not the radio
Make + Android SMS gateway OTP flow is no-code orchestration over the same REST API. We do not ship plugin source in this article. OTP verification. Developer Center. Make HTTP module help.
If the last module is “Set variable: verified = true” on HTTP 201, you automated a queue, not two-factor.
Scenario vs SIM
| Make module | May | Must not |
|---|---|---|
| Trigger (login/webhook) | Start a challenge | Fire on every CRM row |
| HTTP | POST JSON once | Unlimited error handler loops |
| Sleep / router | Wait for human / poll DLR | Tight GET loops on Free |
| Android radio | Submit OTP SMS | Share the promo deviceId |
HTTP module, not a Make plugin we ship
Live JSON in Developer Center. API for OTP verification. Device setup. No packaged PHP/C#/Make SDK.
OTP without a login race
- Store Bearer in Make connections, not in a shared screenshot. Least privilege. Rotate if it leaked into a scenario export.
- HTTP POST JSON with deviceIds. Confirm names in Developer Center. Typical: POST /api/v1/messages.
- Set an idempotency key from the OTP challenge id. A scenario error retry must not send two codes.
- Treat 201 as queued. Next module should not be “user is verified.”
- Cap resends in Make, not by looping the phone. TTL shorter than rage-clicks. Honor STOP even on a “test” scenario.
- Staff canary, then production. Reboot the handset once. If pairing dies, the scenario is not the patient.
Delivery reports. Multi-device.
DLR back into Make
Webhooks: SMS webhook integration on Starter+. Free: poll with backoff. HMAC still required when callbacks exist.
Every scenario run can still text
Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. Paid from $19/month. Device and SMS volume pricing.
Next steps
HTTP module, idempotency, staff canary, OTP radio isolated. Then stop looping a scenario until the operator “filter” blinks — that is not an OTP flow.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
