Automatic SMS Verification with the SMS Retriever API

Updated 28 February 2019


As we all know that SMS and CALL permissions are not allowed by Google easily due to the security of user privacy. So in order to implement the OTP auto read functionality,
we have to implement SMS retriver API suggested by the google. For implementing it, you need to follow the steps given below:-

To implement automatic SMS verification in your app, see the Android and server guides:

Android Guide
Server Guide

Android Guide:-


The SMS Retriever API is available only on Android devices with Play services version 10.2 and newer.

1. Obtain the user’s phone number

2. Start the SMS retriever
When you are ready to verify the user’s phone number, get an instance of the SmsRetrieverClient object, call startSmsRetriever, and
attach success and failure listeners to the SMS retrieval task:


The SMS retrieval task will listen for up to five minutes for an SMS message that contains a unique string that identifies your app.

3. Send the phone number to your server
After you have obtained the user’s phone number and started to listen for SMS messages, send the user’s phone number to your verification server
using any method (usually with an HTTPS POST request).

4. Receive verification messages
When a verification message is received on the user’s device, Play services explicitly broadcast to your app an SmsRetriever.SMS_RETRIEVED_ACTION Intent,
which contains the text of the message. Use a BroadcastReceiver to receive this verification message.

In the BroadcastReceiver’s onReceive handler, get the text of the verification message from the Intent’s extras:


Register this BroadcastReceiver with the intent filter
(the value of the SmsRetriever.SMS_RETRIEVED_ACTION constant) in your app’s AndroidManifest.xml file,
as in the following example, or dynamically using Context.registerReceiver.

5. Send the one-time code from the verification message to your server
Now that you have the text of the verification message, use a regular expression or some other logic to get the one-time code from the message.
The format of the one-time code depends on how you implemented them in your server.

Finally, send the one-time code to your server over a secure connection. When your server receives the one-time code,
it records that the phone number has been verified.


Perform SMS Verification on a Server

The phone verification server is responsible for three tasks:

Constructing a verification message that includes a one-time code and has the format the client-side SMS Retriever API expects
Sending the verification message to the user’s device
Verifying the one-time code when it’s sent back to the server and completing any post-verification tasks your backend requires

In Order to get details for server end functionality, you can go through the following link:-



. . .

Leave a Comment

Your email address will not be published. Required fields are marked*

Be the first to comment.

Start a Project

    Message Sent!

    If you have more details or questions, you can reply to the received confirmation email.

    Back to Home