Post

Did you know there's an easy way to streamline SMS OTP entry on your website?

SMS one-time passwords (OTPs) are common for 2FA, but switching apps to type a 6-digit code causes drop-off and carries high phishing risks. Ideally you should adopt passkeys, but there are steps you can take improve your existing SMS OTP today.

Combining @​domain #​code at the end of the SMS, autocomplete="one-time-code" on the input tag, and the WebOTP API enables one-tap autofill in Safari on iOS/macOS and Chrome on Android without switching to the SMS app. Because the domain is bound, it won't work on phishing sites.

Also, "Modern Web Guidance", our collection of skills for coding agents, now supports these best practices so you can adopt them effortlessly. goo.gle/mwg

Check out the SMS OTP form best practices article to learn more: web.dev/articles/sms-otp-form