telkit
Get started

Use case

Two-factor SMS: one-time codes that arrive

You have a login form and need a second factor your users can manage. Everyone can use SMS. Here is the flow, what telkit does in it, and why SMS should not stand alone.

Get startedAll use cases

Last reviewed 14 October 2026

The problem

The code must arrive within seconds or the user gives up. And a code you cannot confirm was delivered is a support ticket waiting to happen.

telkit neither makes the code nor checks it. Your backend does, where the secret belongs. telkit sends the message from your name and tells you whether it was delivered or failed.

The services that do the job

Everything below is part of the SMS service.
  • Sender nameThe code comes from the name of your service, 3 to 11 characters. We approve each name before it is used.
  • Status per messagesms.status says whether the code was sent, delivered or failed, with the operator's reason when it failed.
  • Limits against abuseSet a monthly limit in kroner on the profile. The company also has a limit on SMS units per day, and limit.reached tells you when it is hit.
  • Test keyWith a test key you can test the login from end to end. Nothing is sent and nothing costs anything.

Example flows

telkit takes part in one step only. The rest belongs in your own backend.

Logging in with a code

  1. The backend makes six digits from a cryptographically random source and stores a hash of the code with an expiry and an attempt counter.
  2. The backend sends the code through telkit, with the login attempt's id as the Idempotency-Key.
  3. The user types the code. The backend compares, counts the attempt and deletes the code after the first correct use.

The code did not arrive

  1. sms.status arrives with state failed and the operator's reason.
  2. The login page offers to send a new code, or another method.
  3. The backend counts new codes per number, so nobody can request a hundred codes to the same phone.

Confirming a new mobile number

  1. The user adds a new number to their profile.
  2. The backend sends a code to that number.
  3. When the code is right, you mark the number as confirmed. Only then is it used for logging in.

What the request looks like

The code goes out from an approved sender name. The event below is what you get when a code did not arrive.
POST /v1/smsbash
curl https://api.telkit.no/v1/sms \  -H "Authorization: Bearer $TELKIT_API_KEY" \  -H "Idempotency-Key: otp-login-8f3a2c" \  -H "Content-Type: application/json" \  -d '{    "profile": "minside",    "to": "+4791234567",    "text": "123456 er koden din til Minside. Den gjelder i 5 minutter.",    "sender": {      "kind": "text",      "name": "Minside"    }  }'
Put the code first in the text, so the user sees it in the notification without opening the message.
Webhook: sms.statusjson
{  "object": "event",  "id": "evt_…",  "type": "sms.status",  "api_version": "1",  "occurred_at": "2026-10-14T08:00:03Z",  "data": {    "eventId": "evt_…",    "mode": "live",    "profileId": "…",    "messageId": "…",    "to": "+4791234567",    "state": "failed",    "units": 1,    "priceOre": 75,    "errorDesc": "…"  }}
errorDesc is the operator's reason. Use it in your log, not in the text you show the user.

What to watch out for

One-time codes by SMS have two weaknesses: one you solve in code, and one you can only limit.
  • Never put a link in a code message. A user who is used to tapping links in such messages is halfway fooled the next time someone sends a fake.
  • SMS is the weakest of the common second factors. A SIM swap moves the number to the attacker, and a fake login page can ask for the code and use it at once. Passkeys and authenticator apps do not have that problem.
  • If you handle money or sensitive personal data, make SMS the fallback rather than the main route.
  • Set a limit per number and per IP address. Without it you pay for every code an attacker requests.
  • Name your service in the message, and keep the code short-lived, for example five minutes.

What it costs

A code message is short and uses one SMS unit.
SMS sent, per unit
NOK 0.75

10,000 code logins a month cost NOK 7,500 excl. VAT.

Prices exclude VAT.

See the full price list

Questions about two-factor SMS

Does telkit make the code for me?

No. Your backend makes and checks the code. telkit sends the message and tells you whether it was delivered.

Is SMS safe enough as a second factor?

It is better than a password alone, but weaker than passkeys and authenticator apps. Use SMS for the users who cannot get on with the others.

How long should the code be valid?

Five minutes is common. The code should stop working after its first correct use, and after three wrong attempts.

Can I send the code to a number outside Norway?

No. telkit sends SMS to Norwegian mobile numbers.

What do I do about users who never get the code?

Look at sms.status for the message. If it failed, offer a new code or another method. If it arrived, the fault is elsewhere, for example a wrong number.

Read more about the services

Other use cases

Send your first code

Register your company, apply for your sender name and test the whole login with a test key.

Get startedSee pricing