# OTP SMS best practices | VeloBotix

> How to send OTP SMS in Sri Lanka: generate in your app, short TTL, rate limits, local routes, branded Sender ID.

Source: https://www.velobotix.app/resources/blog/otp-sms-best-practices

2026-08-17

# OTP SMS best practices for Sri Lankan apps

## Generate the code in your app

VeloBotix delivers SMS. Your backend should create the one-time password with a CSPRNG, store a hash, and expire it in 3–5 minutes.

## Use local routes

Login screens do not wait for grey international routes. Direct Dialog / Mobitel / Hutch / Airtel paths keep OTP SMS inside Sri Lanka.

## Rate-limit and lock out

Cap sends per number per hour. Lock the account after repeated wrong guesses. Log delivery IDs, not raw OTPs.

[SMS gateway](https://www.velobotix.app/sms-gateway-sri-lanka) · [Contact](https://www.velobotix.app/contact)