Key Takeaways
- Symfony OTP on an Android SMS gateway: hash in your app, HttpClient POST /messages, verify in the login form — not a Symfony SMS SDK.
- Stable Idempotency-Key; Messenger retries must not mint new keys.
- DLR/webhooks close the loop; HTTP accept is not login success.
- You bring phone and operator credit. Devices + volume pricing.
- Free/Developer pause at the SMS allowance. No Unlimited SMS titles.
Symfony SMS Gateway with Android Device — OTP is the auth lane on your SIM. Retry policies · OTP use case. HttpClient: Symfony HttpClient. Docs: Developer Center.
Devices and send volume. You fund the SIM.
hashsendverify
OTP flow on Symfony
Controller/command creates the challenge; a small gateway client sends SMS; form submit checks the hash. Messenger is optional for async send — not for inventing new codes on every release.
If the user already typed the first code, a second successful retry is an incident — not resilience.
How to wire OTP
- Hash + TTL in Doctrine (or your store).
- HttpClient POST with Idempotency-Key.
- Rate-limit verify attempts.
- Isolate OTP
deviceIdsfrom campaigns.
curl -X POST "https://app.sms-gateway.app/api/v1/messages" \
-H "Authorization: Bearer $SMS_GATEWAY_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 3f1b0c8a-9d2e-4c77-9f5a-2b6d1e0f4a83" \
-d '{"to":["+14155552671"],"text":"Your verification code is 481920","type":"sms"}'OTP failure table
| Failure | Cause | Fix |
|---|---|---|
| Two codes | New Idempotency-Key on retry | Pin challenge id |
| Accept, no SMS | Doze / prepaid | Phone ops + DLR |
| Always invalid | Hash/clock skew | Fix store — do not resend blindly |
| Allowance exhausted | Free/Developer cap | On Free and Developer, sending pauses when you use the plan SMS allowance rather than silently billing aggregator-style overage. Upgrade or request a custom allowance to continue. |
HttpClient is REST
No Complete Symfony SMS SDK. Confirm live JSON in docs. Idempotent send.
Phone still owns delivery
Next steps
Staging OTP with one staff number; assert single SMS + hash verify. Downloads. Free: 300 SMS lifetime.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
