Maxi SMPP Sandbox

Guide

How to Test SMS OTP and 2FA Flows Without Sending Real SMS

The cases your OTP and 2FA code must survive, and how to reproduce each one safely with a sandbox.

· 6 min read

One-time passwords look simple: send a code, wait for the user to type it. In production the interesting part is everything that goes wrong between those two steps. An SMPP sandbox lets you reproduce those situations on demand, without sending real SMS or paying for them.

The cases to cover

  1. Delivered quickly. The happy path. The code is accepted and the delivery report matches your message.
  2. Delivered late. The report, and in real life the SMS, arrives after your "resend code" timer has already fired. Make sure an old code does not invalidate a newer one by accident.
  3. Not delivered. The report says the message failed. The user must see a useful error or a fallback channel, not an endless spinner.
  4. Expired or never reported. Some messages simply never produce a final report. Your code needs a timeout that does not depend on one.
  5. Rejected by the SMSC. An error in submit_sm_resp must stop the flow immediately, see SMPP error codes.
  6. Resend and abuse limits. Several quick requests must not produce several valid codes or an unlimited SMS bill.

Design your code around the receipts

  • A delivery report is a signal, not proof the user read the code. Do not make login depend on receiving one.
  • Store the message_id from submit_sm_resp with the OTP attempt so you can match the later deliver_sm (see delivery receipts).
  • Keep the code's lifetime independent from the SMS lifetime.

Reproducing the cases in the sandbox

In the sandbox you give each client account a delivery scheme: a delay in seconds and the percentage of reports per status (Delivered, Not Delivered, Expired, Pending, Rejected). Because the scheme belongs to the client account, the simplest approach is one account per scenario:

  • otp-ok: 100% Delivered after 1 second.
  • otp-slow: 100% Delivered after a delay longer than your resend timer.
  • otp-fail: 100% Not Delivered.
  • otp-mixed: 90% Delivered and 10% Not Delivered, for exercising statistics and monitoring.

Your tests then pick the account that matches the case, with no changes to the application code itself.

Want to try this against a real SMPP endpoint? Register for the sandbox and use it free for 3 days, or tell us about your scenario.

Keep reading

Ready to test your SMS traffic?

Get your SMPP sandbox in minutes and use it free for 3 days - or tell us what you are building and we will help you choose a plan.

Start free Contact us