Key Takeaways
- Node OTP over an Android SMS gateway is HTTPS fetch + Bearer env key — not a packaged Node SDK from us.
- Hash challenges at rest; cooldowns per number; thin HTTP handlers; queue the send.
- Verify webhook HMAC on the raw body; never put keys in the browser.
- OEM + plan caps still apply; no Unlimited SMS titles.
- Developer Center owns live REST fields.
- BYO Android and operator credit. We meter devices and volume (Free 300 lifetime; paid from $19/mo).
Summary
Send OTP with Node.js through an Android SMS gateway API using REST — hash at rest, queue the send, verify in your app. Start from Android SMS Gateway API and confirm live parameters in Developer Center. Pricing: devices + volume (Free 300 SMS lifetime; paid from $19/mo); BYO phone and operator credit — pricing.
A Node “SDK wrapper” that echoes OTP digits into Winston logs is not a delivery feature. It is a compliance incident waiting for grep.
REST, not an SDK
Use fetch / undici with Authorization: Bearer from process.env. No official multi-language Node package from us. Confirm path and JSON fields in Developer Center before production.
// Conceptual — confirm URL/fields in Developer Center
const res = await fetch(sendUrl, {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.SMS_GATEWAY_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({ to: e164, text: body, client_ref: challengeId }),
signal: AbortSignal.timeout(15000),
});Context
OTP and marketing must not share unbounded senders. Separate queues and device pools. Prefer GSM-7 friendly templates so short codes stay single-segment. OTP use case.
OTP send design
- Generate code server-side; store hash + TTL + attempt counter.
- Enqueue send with stable
client_ref/ idempotency key. - Return 202-style UX with cooldown; do not block on DLR.
- On submit, compare hash; invalidate challenge.
- Controlled resend under per-number rate limits.
Layer table
| Layer | Owns | Must not |
|---|---|---|
| Node auth service | Hash, TTL, lockout | Log plaintext OTP |
| Worker | REST send + retries policy | Retry 4xx forever |
| Gateway + Android | Queue, radio, DLR when available | Supply operator airtime |
| Webhook handler | HMAC + idempotent status | Trust unsigned POSTs |
Each code spends airtime
Accepted sends meter platform volume and the carrier. Free/Developer pause when allowance is exhausted. OEM rate ceilings and carrier fair-use still apply.
Operations
Alert on device last-seen and Pending age. Canary with staging keys — CI must not empty production prepaid wallets. Setup.
HMAC and least privilege
Verify webhook signatures over the raw body with constant-time compare. Keep API keys server-side only.
Decision guide
Ship hash-at-rest + cooldown before any agent or n8n path touches OTP. Related: n8n webhook pattern.
Checklist
- REST fetch + env Bearer; no client keys.
- Hash + TTL + cooldown + idempotent resend.
- HMAC webhooks; AbortSignal timeouts.
- OTP pool isolated from marketing.
- No SDK product claim; no Unlimited SMS titles.
Next steps
Careful load testing: how to load test carefully.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
