OTP & 2FA Implementation Guide for Sri Lankan Apps

One-time passwords (OTP) and two-factor authentication (2FA) are essential security features for Sri Lankan applications. With increasing digital adoption in banking, e-commerce, and fintech, implementing reliable OTP delivery is critical for user security and trust.

Why OTP/2FA Matters for Sri Lankan Apps

Cyber threats in Sri Lanka have increased by 40% year-over-year. Implementing 2FA reduces account takeover risk by 99.9%. SMS-based OTP remains the most accessible 2FA method in Sri Lanka where smartphone penetration is growing but not universal.

OTP Delivery Architecture

A robust OTP system follows this architecture:

1. User requests OTP — User enters their phone number and requests a verification code
2. Server generates code — Backend generates a random 6-digit code
3. Store with expiration — Code is stored in Redis/cache with a 5-minute TTL
4. Send via SMS API — Code is sent to the user via TXTMSG SMS API
5. User submits code — User enters the code in your application
6. Verify and invalidate — Server verifies the code and invalidates it after use

OTP API Integration with TXTMSG

Here is a complete OTP implementation using the TXTMSG v3 API:

1. Generate and Send OTP (PHP)

2. Verify OTP (PHP)

Rate Limiting and Security

To prevent abuse, implement rate limiting:

• Maximum 3 OTP requests per phone number per hour
• Maximum 5 verification attempts per phone number per 15 minutes
• Implement CAPTCHA for OTP request forms
• Log all OTP requests and verification attempts for auditing

Best Practices for OTP Delivery

• Sub-second delivery — Choose a provider with low latency. TXTMSG averages 140ms delivery
• Retry logic — Implement automatic retry with a different carrier route if delivery fails
• Template messages — Use consistent message templates for better deliverability
• Short expiry — 5 minutes is optimal for security vs. user convenience

FAQ

What is the best OTP delivery time in Sri Lanka?
TXTMSG delivers OTPs in an average of 140ms across all Sri Lankan mobile networks.

How much does SMS OTP cost in Sri Lanka?
SMS OTP costs from LKR 0.59 per message with txtmsg.lk. For high-volume OTP traffic, enterprise plans offer even lower rates.

Can I use alphanumeric Sender IDs for OTP?
Yes, TXTMSG supports alphanumeric Sender IDs (e.g., “Verify”, “SecureApp”) subject to telecom operator approval in Sri Lanka.