Passwords alone are no longer enough. Two-factor authentication (2FA) adds a second layer of security, and in Africa — where mobile phones are near-universal but smartphone authenticator apps are not — SMS is the most widely-adopted second factor.

How SMS 2FA Works

When a user logs in, your app sends a one-time code to their registered phone number. The user enters the code to complete authentication. Even if a password is stolen, an attacker can't log in without the code delivered to the user's phone.

Why SMS 2FA Fits African Markets

  • Works on every phone — no app or internet needed
  • Familiar to users from mobile money and banking
  • Fast to implement with a simple API call
  • Universally available across all operators

Implementing SMS 2FA

Generate a short random code, store it with a short expiry (3–5 minutes), and send it with a single API call:

curl -X POST "https://sms.esmsafrica.io/api/messages/send" \
  -H "Authorization: Bearer $ESMS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "to":        "+254712345678",
    "text":      "Your login code is 728145. It expires in 5 minutes.",
    "sender_id": "eSMSAfrica"
  }'

# → 200 OK
# {"id":"550e8400-...","status":"submitted","route":"ESMS_KE"}

Best Practices

Rate-limit code requests to prevent abuse, expire codes quickly, never reuse a code, use a registered sender ID, and combine SMS 2FA with device recognition to reduce friction for trusted devices. Reliable delivery is essential — a code that arrives late defeats the purpose.