In short
- Say why: every OTP message states its purpose (CST clause 4.6.2).
- One SMS: up to 160 characters in English (GSM-7), 70 in Arabic.
- No links in OTP messages, and a clear "do not share" warning.
- Your sender name shows who the code is from, so the text does not need your brand.
- On Digital Connect: templates approved by your team and by Interkey; OTP sent over REST, SMPP or SOAP; a delivery receipt for each message.
What every OTP message needs
- The purpose: login, verifying a number, a password reset, a payment, a new device. CST's regulations do not allow the code alone.
- The code, early in the message so it is easy to read on a lock screen.
- How long it is valid, matching the expiry your system enforces.
- A warning not to share the code with anyone, including your own staff.
- What to do if the customer did not ask for it, on sensitive actions such as a password reset or a new device.
- One segment. Keep English templates within 160 characters and Arabic templates within 70.
English OTP templates
Each template fits one SMS segment. Replace the codes, times and amounts with your own values.
| Use | Template | Characters |
|---|---|---|
| Login | Your login code is 482915. It is valid for 5 minutes. Do not share this code with anyone, including our staff. | 110 |
| Verify a mobile number | Your code to verify this mobile number is 730264. It is valid for 10 minutes. If you did not request it, ignore this message. | 125 |
| Password reset | Your password reset code is 159837. It is valid for 5 minutes. If you did not ask to reset your password, contact us. | 117 |
| Payment confirmation | Code 604118 confirms your payment of SAR 1,250.00. It is valid for 3 minutes. Do not share it with anyone. | 106 |
| New device | Your code to add a new device to your account is 285043. It is valid for 5 minutes. If this was not you, contact us now. | 120 |
| Delivery handover | Give code 3917 to the courier only when you receive order 58214. Do not share it before delivery. | 97 |
Arabic OTP templates
Arabic text uses Unicode, so one SMS holds 70 characters, or 67 per part when the message is longer. Each template below fits one SMS.
| Use | Template | Characters |
|---|---|---|
| Login | رمز الدخول إلى حسابك 482915، صالح 5 دقائق. لا تشاركه مع أحد. | 60 |
| Verify a mobile number | رمز التحقق من رقم جوالك 730264، صالح 10 دقائق. إن لم تطلبه فتجاهله. | 67 |
| Password reset | رمز إعادة تعيين كلمة المرور 159837، صالح 5 دقائق. إن لم تطلبه فراسلنا. | 70 |
| Payment confirmation | رمز تأكيد دفع 1250 ريال هو 604118، صالح 3 دقائق. لا تشاركه مع أحد. | 66 |
| New device | رمز إضافة جهاز جديد لحسابك 285043، صالح 5 دقائق. لم تطلبه؟ تواصل معنا. | 70 |
| Delivery handover | أعطِ الرمز 3917 للمندوب عند استلام الطلب 58214 فقط. | 51 |
One Arabic letter in an English message switches the whole message to Unicode and its 70-character limit. Send each customer one language, and check templates with the SMS segment calculator.
Formats for automatic code reading on Android
Android apps can read the code from the SMS so the customer does not type it. Google documents two methods, and each sets rules for the message text:
| Method | What the message must contain |
|---|---|
| SMS Retriever API | No longer than 140 bytes; the one-time code; an 11-character hash string that identifies your app. The rest of the text is up to you. |
| SMS User Consent API | A 4 to 10 character alphanumeric code with at least one number. The app listens for five minutes after it asks, and the customer approves reading the message. |
Example for the SMS Retriever API, with the app hash on its own line:
Your login code is 482915. It is valid for 5 minutes. Do not share it. FA+9qCX9VSu
The hash shown is Google's documentation example; use the one generated for your app. One SMS carries 140 bytes, so an Arabic message, hash included, must stay within 70 characters: shorten the Arabic templates above to leave room for the hash. Sources: SMS Retriever API and SMS User Consent API.
Mistakes to avoid
- The code alone, such as "482915". It does not meet CST's rule and gives the customer no context.
- Links in OTP messages. Keep the code and the action in your app, so customers never need to tap a link in a message that carries a code.
- Long brand names or slogans that push the message into a second segment. Your registered sender name already shows who sent it.
- Mixing Arabic and English in one message, which cuts the limit to 70 characters.
- Sending a new code on every tap. Limit retries; see the OTP implementation checklist.
OTP templates on Digital Connect
- Template approval: your team and Interkey approve each template before use.
- Sending: your systems send OTP over REST, SMPP or SOAP, with access limited to whitelisted IP addresses or a VPN connection.
- Sender name: Interkey registers your sender name with the operators through CST's central bulk-SMS system during onboarding.
- Results: a delivery receipt for each message.
- Protection: fraud protection, country blocking and spending limits on your account.
- Pricing: by quote; OTP traffic is priced differently from marketing traffic.
- Permit: Interkey holds CST's permit to provide short message services (SMS).
See OTP SMS for customer verification for the service itself.
Questions about OTP message text
Must an OTP message say what the code is for?
Yes. CST's regulations require a sender to state in the message why the one-time password was sent, and not to send the code alone (clause 4.6.2).
Should we send OTP in Arabic or English?
Use the language the customer chose in your app or account. Arabic templates should stay within 70 characters to remain one SMS.
How many digits should the code have?
Your security policy decides. If you use Android's SMS User Consent API, the code must be 4 to 10 characters with at least one number.
Should we put our brand name in the text?
It is not needed. The registered sender name shows who the message is from, and leaving the brand out keeps the message shorter.
Do OTP templates need approval on Digital Connect?
Message templates on Digital Connect are approved by your team and by Interkey before use. Agree your OTP templates during onboarding.