Add phone-number (OTP) login to your app

How do you add phone-number OTP login to your app?

To add phone-number OTP login to your app you need three pieces: a screen where the user enters their number, a server that generates a short one-time code and sends it through an SMS provider or WhatsApp, and verification logic that checks the code and creates a session if it is correct and still valid. No password, no email, no extra buttons.

Why the phone number in particular in the Gulf? The phone is the primary device, customers already talk to stores, clinics and restaurants on WhatsApp, and many people do not check email daily. Phone login reduces drop-off during sign-up and gives you a verified contact channel for order and appointment notifications.

A phone code proves the user controls the number; it does not prove their official identity. If your app needs verified identity, for leases or financial services for example, read Nafath and phone sign-in for Saudi apps or UAE PASS login for your app.

How does the login journey work, step by step?

1. 1
   Enter the number

   One field with a country picker, defaulting to Saudi Arabia or the UAE depending on your market. Accept the number with or without the leading zero.

2. 2
   Normalize and check

   The server converts the number to international format such as +9665 or +9715, and checks it is from an allowed country and under the request limit.

3. 3
   Generate and send

   A random 4 to 6 digit code, stored hashed with a short expiry, sent via your SMS provider or a WhatsApp template.

4. 4
   Enter the code

   A single-field screen that supports autofill from the message on iOS and Android, with a resend countdown.

5. 5
   Verify

   The server compares the code, rejects expired codes or exceeded attempts, then deletes the code immediately after use.

6. 6
   Session

   The server creates a secure session, creates a new account automatically for a new number, and sends the user on to their destination.

SMS or WhatsApp?

The practical answer for many apps is a primary and a fallback channel. Send via WhatsApp first, for example, and if the user has not entered the code within a minute, show a Send by SMS button. Either way, choose a provider with good coverage in your customers' countries and ask about sender name registration and requirements in each. For more on WhatsApp, read send WhatsApp notifications from your app.

Which settings make OTP codes secure?

The numbers in the table are common examples, not binding rules; tune them to your app's sensitivity. A coffee ordering app is different from one that shows medical test results.

SMS pumping: the bill you do not expect

A well-known fraud has bots request thousands of codes to expensive international numbers, so the fraudster profits from the cost difference while you pay the bill. Protection: an allowed-country list, limits per number, IP address and device, extra verification on suspicious activity, and an alert when message volume suddenly spikes. Details in stop fake sign-ups and OTP abuse.

A solid Arabic experience for the code screen

• Numbers left to right: even on an Arabic page, phone and code fields should run left to right so the digit order does not flip.
• Accept Arabic-Indic digits: many users type ٠٥٥ on an Arabic keyboard; convert them to 055 on the server instead of rejecting them.
• Autofill: enable the one-time code feature on iOS and the SMS retrieval API on Android so the code arrives without typing.
• Clear messages: We sent a code to 0555 *** 123, it arrives in seconds is better than Sent.
• Easy number change: a clear button to go back and fix a mistyped number.
• Message text: include the app name, the code and a short warning not to share it with anyone.

For more common Arabic interface mistakes, see RTL mistakes that make apps feel foreign.

The hard cases: changed numbers, staff and data

1. The customer changed their number: provide an in-account way to update it with a code sent to the new number, plus a fallback recovery path such as email or support with manual verification.
2. Recycled numbers: carriers may reissue old numbers to new people. For sensitive apps, add a verification question or backup email before revealing old data.
3. Staff and admins: an admin panel needs more than a phone code alone; add roles, permissions and extra verification for sensitive actions. Read roles and permissions for staff.
4. Sessions: set session length by how sensitive the app is, and let users sign out of all devices.
5. Personal data: a phone number is personal data under Saudi Arabia's PDPL and the UAE's PDPL; state in your privacy policy why you collect it and how you use it.

Build it with Fanann: a ready prompt and checklist

In Fanann, phone-number login comes as part of the managed database along with roles and permissions, and you can customize channels and limits through chat.

Pre-launch checklist

• Saudi and UAE numbers in different formats: with zero, without, with country code, and in Arabic digits.
• A wrong code then a correct one, an expired code, and exceeding the attempt limit.
• Tapping resend repeatedly and confirming the cooldown.
• A number from a country that is not allowed.
• Autofill on a real iPhone and a real Android phone.

Frequently asked questions

Terms in this article