Android SMS Retriever and User Consent: Reading OTPs Without Risky Permissions

Asking for permission to read all text messages scares users and can get an app rejected from the store. Android offers two APIs that read only the verification message. Pick the right one and your flow gets faster and safer.

Two APIs, two cases

SMS Retriever in short

1. Compute the app hash for your signing key.
2. Ask your server to put the hash at the end of the message.
3. Start the retriever in the app before you request the code.
4. Parse the code from the received text.
5. Verify on your server, never only in the app.

Common problems

• The hash differs between debug and release builds.
• The message is longer than the allowed size.
• The receiver started after the message arrived.

Keep the fallback

Always keep manual entry. Some devices, languages and carriers will not deliver in the expected format.

Policy note

Store rules about SMS permissions change. Read the current rules before you publish.

Build checklist

1. Create the hash for the debug key and for the release key.
2. Add the hash to the message template.
3. Test with a real message, not a mock.
4. Handle timeouts after five minutes.
5. Fall back to manual entry.

Common message mistakes

• Adding emoji that raise the message length.
• Placing the hash anywhere but the end.
• Sending the code in a link only.
• Translating the message in a way that breaks the format.

Questions people ask

Do I need the read-SMS permission?

Not for these two APIs, which are designed to avoid it.

Can I test with a virtual number?

You can test the sign-up path with a number from OtpGet, but check the message format your server sends.

Related guides and pages

• OTP API for developers
• Virtual numbers for OTP verification
• OTP autofill on the web

Create a free OtpGet account and try it with a small balance.