Definition
A one-time password (OTP) is a short code that is valid for a single login or transaction, usually for a few minutes. Businesses send it by SMS, WhatsApp, voice or email, or generate it in an authenticator app, to verify that the user controls a number, inbox or device.
OTPs are either generated by an algorithm both sides share (HOTP, RFC 4226, counter-based; TOTP, RFC 6238, time-based, as used in authenticator apps) or created randomly by a server and delivered over a messaging channel. For messaging OTPs, the server stores a hash of the code with an expiry and an attempt counter.
Good practice: 4–8 digits, short validity, a limit on wrong attempts, a cooldown before resending, and no reuse. Keep the message short, put the code near the start, state the brand and add a warning not to share the code. Never include marketing content in an OTP message.
Channel choice matters. SMS reaches almost every phone; WhatsApp authentication templates support copy-code, one-tap and zero-tap autofill on Android; voice OTP reaches landlines and users who cannot read a screen. Many businesses use channel fallback, for example WhatsApp first, then SMS, then voice.
OTP endpoints are a target for SMS pumping (artificial inflation of traffic). Rate-limit by phone number, IP and device, restrict destination countries you do not serve, and monitor the share of codes that are actually entered.
OmniChannels.ai sends OTPs over SMS, WhatsApp authentication templates (one-tap, zero-tap and copy-code) and voice.
Example
482917 is your Acme verification code. It expires in 5 minutes. Do not share it with anyone.