How do I send OTP and verification codes by SMS in Uganda?

• The user enters their phone number in your app.
• Your server generates a random code, stores a hash of it with a short expiry, and sends it by SMS.
• The user types the code back; your server compares it, then deletes it.

// Server side only — never expose your API key in a browser or app bundle.
import crypto from "node:crypto";

export async function sendOtp(phone) {
  const code = crypto.randomInt(100000, 1000000).toString(); // 6 digits
  // Store a hash of `code` with a short expiry (e.g. 5 minutes) before sending.

  const res = await fetch("https://app.bulksmsug.com/api/v1/send-sms", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.BULKSMSUG_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      number: phone,
      message: `Your verification code is ${code}. It expires in 5 minutes. Do not share it.`,
    }),
  });

  const data = await res.json();
  if (!res.ok) throw new Error(data.data); // e.g. "Insufficient credits"
  return data.id; // keep this to check delivery status later
}

Every send returns a message ID — keep it so you can check delivery if a user reports a missing code. See the SMS API guide for the full request and response.

• Generate codes with a cryptographically secure random function on the server.
• Expire codes after a few minutes and allow only a handful of attempts.
• Limit how often a code can be resent to the same number.
• Store a hash of the code rather than the code itself.
• Keep your API key on the server, never in the app.

• Validate numbers before sending — a Ugandan mobile number has 9 digits after +256.
• Keep the message in plain text; emoji switch it to Unicode and can split it.
• If a code doesn't arrive, check its status: Buffered usually means the phone is off or out of coverage; Rejected means the network refused it.