The text never leaves.
Your test gets the code anyway.

1. 01

   Send real SMS

   You pay for every message on every CI run. Delivery takes as long as the carrier decides, so tests time out at random. And you still need a phone, or a paid inbox, to read the code back.

2. 02

   Hard-code a test code

   if (phone === TEST_PHONE) code = "000000" works fine until one config mistake ships it to production. Then it's a key to every account on that number.

3. 03

   Write your own fake

   Fine for plain SMS. Useless with Verify APIs (Twilio Verify, Vonage Verify), where the provider generates the code and your fake never sees it. Then you build it again for the next project.

1. Your app

   Sends as usual

   Calls your provider's SDK: messages.create, sms.send, a Verify request. Same SDK, same code path as production.

2. otpmock

   Catches the message

   Answers in your provider's exact response format, keeps the message for 10 minutes and pulls the code out of the text.

   Carrier network never contacted

3. Your test

   Reads the code

   Asks the inbox over HTTPS and types the code in. Verify checks pass with the right code, exactly like the real provider.

  import twilio from "twilio";
import { OtpMockHttpClient } from "./twilio-node-client.mjs";
  export const sms = twilio(process.env.TWILIO_ACCOUNT_SID, process.env.TWILIO_AUTH_TOKEN, {
  httpClient: process.env.OTPMOCK_URL ? new OtpMockHttpClient(process.env.OTPMOCK_URL) : undefined,
  });

• TwilioProgrammable Messaging and Verify v2twilio
• VonageSMS API, Messages API and Verify v2@vonage/server-sdk
• AWS SNSPublish to a phone number@aws-sdk/client-sns
• InfobipSMS v2 (/sms/2/text/advanced) and v3 (/sms/3/messages)@infobip-api/sdk
• SinchSMS REST API batches@sinch/sdk-core
• PlivoSend message APIplivo
• NetgsmREST v2 SMS and OTP@netgsm/sms
• İleti MerkeziJSON SMS API@iletimerkezi/iletimerkezi-node

Using something else? Send to the generic HTTP API from a test-only branch. All providers

test("sign up with a phone number", async ({ page }) => {
  const phone = otp.randomPhone();            // unique per test

  await page.getByLabel("Phone").fill(phone);
  await page.getByRole("button", { name: "Send code" }).click();

  const { code } = await otp.waitForCode(phone);
  await page.getByLabel("Verification code").fill(code);

  await expect(page.getByText("Welcome")).toBeVisible();
});

// cypress.config.js: on("task", { waitForCode: (phone) => otp.waitForCode(phone).then((r) => r.code) })

it("signs up with a phone number", () => {
  const phone = "+1555" + Cypress._.random(1e7, 9e7);

  cy.get("[name=phone]").type(phone);
  cy.contains("Send code").click();

  cy.task("waitForCode", phone).then((code) => cy.get("[name=code]").type(code));
  cy.contains("Welcome").should("be.visible");
});

# Latest code sent to a number (404 until one arrives)
curl https://api.otpmock.com/v1/inbox/%2B15550142/code \
  -H "Authorization: Bearer $OTPMOCK_API_KEY"

{ "code": "482913", "messageSid": "SM6926…", "receivedAt": 1791406301420 }

The otp helper is a single dependency-free file. Get it from the docs. Using an AI coding assistant? Point it at otpmock.com/llms-full.txt and it can do the whole integration.

Compatible with

Twilio (Messaging, Verify v2), Vonage (SMS, Messages, Verify v2), AWS SNS, Infobip, Sinch, Plivo, Netgsm and İleti Merkezi. Each is tested against the provider's official Node.js SDK, error formats included. Anything else can use the generic HTTP API.

Code extraction

Looks for a 4 to 8 digit number next to words like code, OTP or PIN, then falls back to the first one in the message.

Parallel tests

Every test can use its own virtual number. Workers never share an inbox.

Stale codes

A since timestamp ignores anything left over from the previous run.

Consistency

A code is readable the moment your app's send call returns. No eventual consistency, no sleeps.

Isolation

Each account gets its own isolated storage, shared by its API keys. No other customer can see your messages.

Retention

Messages and verifications are deleted after 10 minutes.

Infrastructure

Cloudflare Workers and Durable Objects.

Real SMS sent

Never.

Prices in USD, billed monthly. Payments are processed by Creem, our merchant of record, which also handles sales tax and VAT. Cancel any time. See the refund policy.