Key Takeaways
- n8n Android SMS gateway OTP flow: generate challenge in your DB, POST SMS via HTTPS, verify in a later node — the phone is the radio.
- Use HTTP Request + Bearer from credentials vault. Not a packaged multi-language SDK.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Each accepted OTP still spends operator credit.
- Free 300 SMS lifetime is easy to burn with Wait + resend loops.
- Isolate OTP devices from campaign workflows.
- Developer Center owns live JSON fields.
An n8n OTP flow on an Android SMS gateway is three jobs: mint a code, send it through your SIM, verify what the user typed. Hub: OTP verification. n8n overview. n8n docs.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
A Wait node that fires
sendevery thirty seconds is not resilience — it is a prepaid SIM shredder.
n8n OTP shape
Trigger → create challenge (hash + TTL in your store) → HTTP POST to the gateway → respond to the client → later webhook/form → verify. Live send params: Developer Center.
Nodes vs responsibilities
| Node | Owns | Must not |
|---|---|---|
| Function / DB | Code hash, TTL, attempts | Log plaintext codes |
| HTTP Request | POST message + Idempotency-Key | Retry forever |
| Wait / Form | User input window | Auto-resend without cap |
| Verify Function | Compare attempt | Call send again “to help” |
HTTP Request, not a fake SDK
Bearer token from n8n credentials. JSON { to, text }. Optional deviceIds for the OTP handset. Language samples elsewhere are HTTPS recipes — not an npm “complete SDK” product.
Wait without resend storms
Cap attempts and TTL in your store. Same pattern as wait-for-OTP concepts.
Device and airtime checks
Before production login, confirm the phone is online and the SIM has credit. Webhooks for DLR: webhook guide.
Related reading
Make.com OTP flow. Multi-device.
Checklist
- Challenge hashed server-side.
- Idempotency-Key on send.
- Credentials vaulted in n8n.
- OTP device dedicated.
- Resend policy explicit.
- Operator credit monitored.
Next steps
Run a staff canary, then pick devices + SMS volume for peak auth.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
