Post

Did you know there's an easy way to streamline SMS OTP entry on your website?

SMS one-time passwords (OTPs) are common for 2FA, but switching apps to type a 6-digit code causes drop-off and carries high phishing risks. Ideally you should adopt passkeys, but there are steps you can take improve your existing SMS OTP today.

15/10/26, 8:26 am0 reposts0 likes

Eiji Kitamura / えーじ

@agektmr.com

Combining @domain #code at the end of the SMS, autocomplete="one-time-code" on the input tag, and the WebOTP API enables one-tap autofill in Safari on iOS/macOS and Chrome on Android without switching to the SMS app. Because the domain is bound, it won't work on phishing sites.

Eiji Kitamura / えーじ

@agektmr.com

Also, "Modern Web Guidance", our collection of skills for coding agents, now supports these best practices so you can adopt them effortlessly. goo.gle/mwg

goo.gleModern Web Guidance | Chrome for DevelopersSkills that embed web platform expertise and best practices directly into your coding agents.

Eiji Kitamura / えーじ

@agektmr.com

Check out the SMS OTP form best practices article to learn more: web.dev/articles/sms-otp-form

web.devSMS OTP form best practices | web.devAsking a user to provide a one-time password is a common way to confirm a user's identity. Learn best practices to build an SMS OTP form, with great user experience.

Eiji Kitamura / えーじ

@agektmr.com

Here's how it works on Android Chrome