Apple IOS OTP autofill SMS api correct criteria

user_2446698 0
Viewed 3015

I see the API documented for IOS 12 on how to retrieve a OTP from SMS for your app password field. But I can't seem to find documentation for the other side... sending the OTP to a user. What is the criteria of an OTP that can be detected by IOS for the user to autofill. For example is there a character limit or a certain pattern that must be followed.

I am referring to this iOS feature https://9to5mac.com/2018/06/04/safari-security-code-auto-fill/

Specifically what is the criteria of an OTP to be received by this api. If I sms a user “your one time passcode is: thebirdwenttothepark” would it be picked up? Obviously there is a specification that defines what an OTP is according to iOS.

backend swift iphone ios
1 Answers

The message that is received should just contain "code" or "passcode" in it. You should check this medium article if you need more detail.

EDIT

  • The code that is sent must be numbers only (integers) and must be minimum of 4 digits and the maximum of 9 digits.
  • It can contain spaces but it's recommended that it doesn't since the digit recognition can get complicated, for example 235 876 is recognized as is ("235 876 with spaces included"), but 2354 2356 only recognizes "354 2356"

And the text field that you have in the app on device should have

  if #available(iOS 12.0, *) {
        self.textField.textContentType = .oneTimeCode
    }

You can test your codes on device before you start implementing it on the backend by using iMessage, simply send an iMessage to the device that you are testing (that has the text field with .oneTimeCode enabled) and it will pick up the codes.

Also I would recommend reading this Apple resource about domain-bound codes that are a more secure way of using OTP (it is only supported from iOS 14 and Big Sur)

user_153701040
Related