OTP SMS Gateway in India: DLT Rules, Setup and Best Practices (2026)
An OTP SMS gateway is a service that connects your app to Indian mobile operators so one-time passwords reach users' phones within seconds. In India every OTP must be sent through a DLT-registered entity, sender ID (header) and approved template, so a gateway is only as reliable as its DLT setup and operator routes.
Business messaging guides for Indian businesses
How an OTP SMS travels from your app to the user
When a user taps Send OTP, your backend generates a code and calls the gateway's API. The gateway checks the request, submits it to the operator through the DLT layer, and the operator delivers the SMS to the handset. Your app then verifies the code the user types in.
- Your app generates a random one-time code and stores a hashed copy with an expiry time.
- Your backend calls the gateway API with the mobile number, your Entity ID, template ID and the code as a template variable.
- The DLT system validates the sender header and template. Messages that do not match an approved template are blocked, often without a clear error.
- The operator delivers the SMS, and the gateway returns delivery status through a report or webhook.
- The user enters the code, and your backend compares it with the stored value before it expires.
DLT requirements for OTP SMS in India
TRAI requires businesses to register on a DLT (Distributed Ledger Technology) platform run by an operator before sending commercial SMS. OTPs fall under the transactional or service category, which is not subject to the promotional time restrictions and can reach numbers on the DND list.
- Principal Entity registration: your business registers on a DLT platform with company documents and KYC, and receives an Entity ID that is sent with every message.
- Header (sender ID) registration: a six-character alphanumeric sender name that identifies your brand, for example the name that appears before the message. Operators append a category suffix to the header.
- Content template registration: every OTP message must match an approved template. The brand name should appear in the template, and variable fields, such as the OTP itself, are tagged by type.
- Link rules: URLs in templates must be full links, not shorteners, and are checked against a whitelist. OTP messages rarely need links, so avoid them.
- No promotional text: adding offers or promotional wording to an OTP template can cause it to be treated as promotional and blocked or delayed.
Rules are updated periodically by TRAI and operators. A good gateway keeps up with these changes and helps you re-register templates when required. If you are new to DLT, read our DLT registration guide before you choose a provider.
How to choose an OTP SMS gateway: a checklist
| What to check | Why it matters |
|---|---|
| Dedicated transactional route | OTPs should not queue behind promotional traffic. Ask how routes are separated. |
| Direct operator connectivity | Fewer intermediaries means faster delivery and better traceability under TRAI's rules. |
| Delivery reports and webhooks | You need per-message status to debug failures and to trigger fallbacks. |
| DLT support | Help with entity, header and template registration saves days at launch. |
| Retry and fallback options | Automatic voice OTP or WhatsApp fallback improves completion when SMS is delayed. |
| API quality and docs | Clear REST API, sandbox, SDKs, rate limits and error codes reduce integration time. |
| Uptime and support | OTP failures block logins and payments, so check SLAs and support hours. |
| Pricing | Compare the all-in per-SMS price at your volume, including any minimum commitments. |
OTP best practices that improve delivery and security
- Use 4 to 6 digit random codes generated with a cryptographically secure generator. Never reuse a code.
- Set a short expiry, commonly 3 to 10 minutes, and invalidate the code after one successful use.
- Limit attempts. Lock or slow down verification after a few wrong entries to stop brute-force guessing.
- Rate-limit requests per number, device and IP, and add a resend cooldown, for example 30 seconds, to prevent SMS pumping and bill abuse.
- Store only a hash of the code, and keep OTP values out of application logs.
- Keep the message short. State the brand, the code, the validity period and a warning not to share it.
- Enable autofill: use the Android SMS Retriever API and the iOS one-time-code field so users do not have to switch apps.
- Verify that the number belongs to the user before sending, and validate its format to avoid wasted sends.
Banks and other regulated institutions should also follow RBI and sector guidance. For example, banking OTP messages should not contain clickable links.
What to do when an OTP does not arrive
Delays happen because of handset issues, poor coverage, full inboxes or operator congestion. Design your flow so that users are never stuck.
- Show a clear resend button with a countdown and a limit on retries.
- Offer a voice OTP that reads the code aloud when SMS fails.
- Offer a WhatsApp authentication message for users who have WhatsApp and opted in.
- Monitor delivery reports by operator and circle, and alert on sudden drops so that you can react quickly.
OTP SMS cost in India
OTP SMS is priced per message and typically sits in a small per-SMS range that falls as volume grows. When comparing offers, look beyond the headline rate: check minimum recharge, credit validity, whether failed messages are billed, and whether DLT registration support is included. Our SMS API pricing page lists current ConnexBetter plans.
Frequently asked questions
Is DLT registration mandatory for OTP SMS in India?
Yes. Businesses must register their Entity, sender header and message templates on a DLT platform before sending OTPs. Messages that do not match an approved template are blocked.
Are OTP messages delivered to DND numbers?
Transactional and service messages such as OTPs are not subject to DND restrictions or promotional time windows, provided they use approved templates and contain no promotional content.
How long should an OTP be valid?
Most services use 3 to 10 minutes. Shorter validity is safer, but leave enough time for delivery delays and manual entry. Always invalidate the code after one successful use.
Why is my OTP SMS delayed or not delivered?
Common causes are a template that does not match the approved text exactly, an unregistered header, a non-whitelisted link, operator congestion, the handset being off or out of coverage, or the message being routed through a promotional route. Check delivery reports and the template first.
What is the best fallback when SMS OTP fails?
A voice OTP or a WhatsApp authentication message. Both give users another way to receive the code without restarting the login flow.
Set up OTP SMS with ConnexBetter
DLT registration support, a dedicated transactional route and delivery reports through API and webhooks.
Explore OTP SMS service