2026-08-17
OTP SMS best practices for Sri Lankan apps
Generate the code in your app
VeloBotix delivers SMS. Your backend should create the one-time password with a CSPRNG, store a hash, and expire it in 3–5 minutes.
Use local routes
Login screens do not wait for grey international routes. Direct Dialog / Mobitel / Hutch / Airtel paths keep OTP SMS inside Sri Lanka.
Rate-limit and lock out
Cap sends per number per hour. Lock the account after repeated wrong guesses. Log delivery IDs, not raw OTPs.