Key Takeaways
- US login OTP on an Android gateway is your AT&T, T-Mobile, or Verizon SIM — not a 10DLC campaign we register for you.
- 10DLC and aggregator A2P exist because carriers filter application-to-person traffic. A handset path is a different product with phone ops.
- Keep promotional SMS off the OTP radio. TCPA consent for marketing is not the same as sending a code the user just requested.
- Measure on cold US handsets. Do not promise aggregator-style SLAs on GSM from a spare phone in a closet.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Carrier airtime is yours.
What this page is not
Not the market overview. That is SMS gateway for the USA. Not a 10DLC onboarding kit. Not TCPA counsel. These notes are login OTP on a handset you own versus the aggregator path most US SaaS teams default to.
If you needed The Campaign Registry, you needed an aggregator. A spare Pixel in a closet is a different product.
Own SIM vs 10DLC for OTP
US carriers built 10DLC because application-to-person SMS from long codes was being filtered. A consumer SIM sending login codes can still work for a small, known CLI — and can also get throttled without a ticket you can escalate. Compare TCO on Twilio vs Android SMS gateway: per-message + rented numbers versus devices, platform volume, and your airtime. Pattern: OTP verification.
US OTP decision table
| Need | Handset gateway | 10DLC / CPaaS |
|---|---|---|
| Zero phone ops | No | Yes |
| Local CLI users already saved | Yes, your SIM | Rented number |
| National reach, mixed MVNOs | Measure; do not promise | Usually stronger |
| Brand/campaign registration | Not this product | Their job |
| OTP isolated from marketing | Separate deviceIds | Separate messaging service |
TCPA, consent, and STOP
Educational consumer baseline: FCC unwanted calls and texts. Industry messaging principles: CTIA. A code the user just typed their number to receive is not a listing alert. Still honor STOP on that MSISDN for promo lanes via auto-reply and STOP. Do not paste a 10DLC-style legal novel into the OTP PDU if it breaks SMS Retriever.
Stand up a US OTP radio
- Decide SIM path vs 10DLC. Local CLI + phone ops vs rented number + campaign registration. Do not run both on one identity story.
- Pair a dedicated US OTP phone. Charger, Wi-Fi, OEM exemptions. Nickname otp-us. Not the founder’s daily driver.
- ASCII code, no promo footer that breaks parsers. {app} code {otp}. Expires in 10m. Identification can live on the product, not a 300-character TCPA novel in the PDU.
- Idempotent resend. signupId + template. Cap retries. Failed loops still debit the SIM.
- Canary AT&T, T-Mobile, and Verizon staff SIMs. Cold handsets. Reboot. Watch DLR, not only HTTP 201.
- Keep marketing off this radio. 10DLC blasts, if you have them, are another vendor. CSV nurture never shares deviceIds with OTP.
Pairing: device setup. DLR: delivery reports. API: SMS API documentation.
AT&T, T-Mobile, Verizon quirks
Canary all three. MVNOs ride those radios with extra filtering. OEM battery killers still dominate overnight pairing. Dual SIM ≠ a second device — multi-device and dual SIM.
Airtime and platform fee
Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance. Free is 300 SMS lifetime for staff canaries. Paid from $19/month. Device and SMS volume pricing. There is no unlimited US OTP SKU.
Next steps
Pick the stack with eyes open, isolate the auth phone, canary the three nationals, and keep 10DLC marketing somewhere else.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- SMS gateway by regionCountry-specific notes
