OTP (one-time password)
A short code delivered by SMS and valid once, briefly, that signs people in, confirms phone numbers and, in delivery apps, proves a parcel changed hands.
Updated October 2026 · with examples from our own builds
What does OTP mean in practice?
OTPs are everywhere in Indian apps: phone-number sign-in, password resets and confirming a handover between two people. The server generates a code, sends it through an SMS provider and accepts it once, within a time limit.
Each SMS is billed, which makes OTP an abuse target as well as a security feature: a sign-up form without limits can be used to send thousands of messages at your expense. Codes also need a cap on wrong attempts so they can't be guessed.
The experience matters too: clear messages for a wrong code and for too many attempts, and a sensible resend timer.
OTP at a glance
- Sent via
- An SMS provider, billed per message
- Must have
- Expiry, single use and a cap on wrong attempts
- Abuse to block
- Scripts that trigger mass sends
Where has OTP come up in our builds?
Sign-in and password reset by SMS one-time code run through MSG91, with clear wrong-code and too-many-attempts states, alongside email sign-in.
Pickup and drop each need a code from the sender or receiver, a code stops working after five wrong tries, and the SMS codes account for ₹0.40 of a trip's third-party cost.
Common questions about OTP
How do I stop bots running up my SMS bill?
Rate-limit OTP requests per phone number and per IP address, add a resend delay and watch daily send counts for spikes. Every code costs money, so the limits belong in the budget as well as the security plan.
Can one-time codes be used for more than sign-in?
Yes. Pakka uses them to confirm that a parcel changes hands at pickup and drop, with the code coming from the sender or the receiver.
Related terms
Planning a product and not sure where OTP fits? Ask us, or browse all 116 terms in the glossary.