OTP SMS API: Send Verification Codes to Israeli Phone Numbers

OTP by SMS means sending a short one-time password to a user's phone to prove they hold that number. With the Global SMS API, your server generates the code and makes one HTTPS call. The message goes out with top-priority routing directly to Israeli mobile carriers and typically reaches the handset in 2 to 5 seconds.

How SMS verification works

1. The user asks for a code – enters a phone number on a sign-up, login or password-reset form.
2. Your server creates the code – a random 4–6 digit number, stored server-side (preferably hashed) with an expiry time.
3. One API call sends it – an HTTPS POST to the Global SMS API with the number and the message text.
4. The user types the code – your server compares it with the stored value, checks the expiry and completes the action.

Global SMS delivers the message. Generating, storing and checking the code stays in your system, so you keep full control of the logic and the data.

When to use OTP SMS

• Phone number verification at sign-up.
• Two-factor authentication (2FA) at login.
• Password reset without waiting for an email.
• Approving a sensitive action, such as a payment or a change of bank details.
• Confirming a delivery handover with a courier.

How to write the OTP message

• Put the code first, so it is visible in the lock-screen preview.
• Name the service and the purpose, for example "to reset your password".
• State the expiry – five minutes is enough in most cases.
• Add a short warning for users who did not request the code.
• No links and no marketing – an OTP message is purely operational.

The last line in the third example lets supporting browsers on Android offer to fill in the code automatically on www.example.com. More examples are in the SMS templates library.

Code sample

Node.js: create, send and verify a code

import crypto from "node:crypto";

const codes = new Map(); // use Redis or your database in production

export async function sendOtp(phone) {
  const code = crypto.randomInt(100000, 1000000).toString();
  const hash = crypto.createHash("sha256").update(code).digest("hex");
  codes.set(phone, { hash, expires: Date.now() + 5 * 60 * 1000, tries: 0 });

  await fetch("https://api.globalsms.co.il/v1/send-sms", {
    method: "POST",
    headers: { "Content-Type": "application/json; charset=utf-8" },
    body: JSON.stringify({
      apiKey: process.env.GLOBALSMS_API_KEY,
      sender: "MyBrand",
      recipients: phone,              // e.g. "0501234567"
      message: `${code} is your MyBrand verification code. It expires in 5 minutes.`
    })
  });
}

export function verifyOtp(phone, input) {
  const entry = codes.get(phone);
  if (!entry || Date.now() > entry.expires || ++entry.tries > 5) return false;
  const hash = crypto.createHash("sha256").update(String(input)).digest("hex");
  const ok = crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(entry.hash));
  if (ok) codes.delete(phone);
  return ok;
}

cURL

curl -X POST "https://api.globalsms.co.il/v1/send-sms" \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "YOUR_API_KEY",
    "sender": "MyBrand",
    "recipients": "0501234567",
    "message": "482910 is your MyBrand verification code."
  }'

More languages (PHP, Python, C#) are on the SMS API page.

Security checklist for OTP by SMS

• Rate-limit requests per phone number and per IP address, and wait 30–60 seconds before allowing a resend.
• Limit attempts – lock the code after a few wrong tries.
• Accept only the countries you serve. If your users are in Israel, accept only Israeli mobile prefixes. This blocks "SMS pumping" fraud, where bots request codes to expensive international numbers. A validation pattern is in the Israeli phone number guide.
• Add a CAPTCHA or bot check on public forms that send codes.
• Store codes hashed and expire them after one use.
• Watch delivery reports – if a code is not delivered within a reasonable time, let the user resend it or use another verification method.

Why use a local provider for OTP in Israel

OTP is the one message type where seconds matter: if the code is late, the user gives up. Global SMS connects directly to Israeli carriers without international intermediaries and routes OTP traffic with top priority. Because pricing is per message in Israeli shekels with no monthly fee, the cost per code is lower than with international providers. See the Twilio alternative comparison.

Frequently asked questions

Related pages

• SMS API
• Twilio alternative for Israel
• OTP in the SMS in Israel guide
• Israeli phone number format

Last updated: November 3, 2026 · Global SMS Ltd., Haifa, Israel