Mobile OTP autofill for Verify

​

1. Why autofill lifts OTP conversion

​

2. Template the message body for autofill

1. The code is the last digit run in the body. Platform scanners pick the final numeric run that looks like a code. Any number after it (an order id, a year, a support line) becomes the suggested “code” instead.
2. End the body with an @your-domain line. iOS uses it to bind the suggestion to your domain for web-to-app handoff, and Chrome’s Web OTP API uses it to offer the code to your focused web page.
3. End the body with your Android app hash line. The SMS Retriever delivers a message to your app only when the last line is that app’s 11-character hash (computation in section 5).

{{app_name}}: your verification code is {{code}}
@verify.example.com
sR7gcWr2hBH

• Line 1 renders your app name and the 6-digit code. {{code}} is the last digit run; keep every later line free of digit runs (the hash’s isolated digits never parse as a code).
• Line 2 is the domain token. Replace verify.example.com with a domain you control and, for the iOS handoff, one you have registered as an associated domain (section 4).
• Line 3 is the Android app hash, one per Android app package and signing key. If you ship two Android apps that both consume the code, you cannot put two hashes on one body; use the SMS User Consent API for the second app (section 5).

​

3. Web

<form action="/verify/complete" method="post">
  <label for="otp">Enter the 6-digit code</label>
  <input
    id="otp"
    name="otp"
    type="text"
    inputmode="numeric"
    autocomplete="one-time-code"
    pattern="[0-9]{6}"
    maxlength="6"
    autofocus
  />
  <button type="submit">Verify</button>
</form>

const input = document.getElementById('otp');
if (window.OTPCredential) {
  const abort = new AbortController();
  navigator.credentials
    .get({ otp: { transport: 'sms' }, signal: abort.signal })
    .then((cred) => {
      if (cred) input.value = cred.code;
    })
    .catch(() => abort.abort()); // unsupported or timed out: manual entry still works
}

​

4. iOS native

// UIKit
codeField.textContentType = .oneTimeCode
codeField.keyboardType = .numberPad

// SwiftUI
TextField("6-digit code", text: $code)
    .textContentType(.oneTimeCode)
    .keyboardType(.numberPad)

​

5. Android native

SmsRetriever.getClient(this).startSmsRetriever()

class OtpSmsReceiver : BroadcastReceiver() {
    override fun onReceive(context: Context, intent: Intent) {
        if (intent.action != SmsRetriever.SMS_RETRIEVED_ACTION) return
        val status = intent.getParcelableExtra<Status>(SmsRetriever.EXTRA_STATUS) ?: return
        when (status.statusCode) {
            CommonStatusCodes.SUCCESS -> {
                val body = intent.getStringExtra(SmsRetriever.EXTRA_SMS_MESSAGE) ?: return
                val code = Regex("\\d{6}").find(body)?.value
                code?.let { sendToYourBackend(it) } // backend calls POST /api/v1/verify/check
            }
            CommonStatusCodes.TIMEOUT -> showManualEntry() // no matching SMS within 5 minutes
        }
    }
}

CERT_B64=$(keytool -exportcert -alias release -keystore release.keystore | base64 | tr -d '\n')
printf 'com.example.app %s' "$CERT_B64" | openssl dgst -sha512 -binary | base64 | cut -c1-11

​

6. Wire it to Orbit Verify

1. Edit the template under Verify → Configuration → Templates (configuration console guide) to the body from section 2, with your domain and hash.
2. Send through the normal SMS factor: POST /api/v1/verify/send with channel: "sms", exactly as in Verify in 30 minutes.

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/send" \
  -H "X-API-Key: $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+14155552671",
    "channel": "sms",
    "profile_id": "vprof_7a1c0e2b…"
  }'

3. Pin a test send and read the rendered body. Send once with your sandbox key (dv_test_sk_…, magic numbers) and open that send’s delivery log row: the rendered body should show the real code digits plus both suffix lines, untouched. This catches template-engine mistakes (a swallowed @ line, a trailing space merging the hash into the previous line) before you spend a live send.
4. Send one live verification to a test device and confirm the device receives exactly that body. The rendered body a phone receives is your template, verbatim, with {{code}} replaced:

Acme: your verification code is 482910
@verify.example.com
sR7gcWr2hBH

5. Check as usual. The client (web field, iOS banner tap, or Android receiver) extracts 482910; your backend validates it with POST /api/v1/verify/check. Autofill changes nothing about the check call.

​

7. Testing matrix

​

Next steps

• Verify in 30 minutes — the send/check loop this guide builds on.
• Verify factor suite — TOTP, push, and passkey factors alongside SMS.
• SMS channel — sender IDs, segments, and delivery semantics for the SMS factor.
• Verification lifecycle — statuses a verification moves through from send to approval.