How to automate OTP and SMS 2FA in tests and scripts

const API = "https://busysms.net/api/v1/codes";

export async function waitForSmsCode(
  opts: { phone?: string; service?: string; timeoutMs?: number } = {},
): Promise<string> {
  const params = new URLSearchParams({ timeoutMs: String(opts.timeoutMs ?? 60_000) });
  if (opts.phone) params.set("phone", opts.phone);
  if (opts.service) params.set("service", opts.service);

  const res = await fetch(`${API}?${params}`, {
    headers: { Authorization: `Bearer ${process.env.BUSYSMS_API_KEY}` },
  });
  if (!res.ok) throw new Error(`BusySMS ${res.status}: ${await res.text()}`);

  const { code } = (await res.json()) as { code: string | null };
  if (!code) throw new Error("No new SMS code arrived in time");
  return code;
}

import os
import requests

API = "https://busysms.net/api/v1/codes"


def wait_for_sms_code(phone=None, service=None, timeout_ms=60_000):
    params = {"timeoutMs": timeout_ms}
    if phone:
        params["phone"] = phone
    if service:
        params["service"] = service

    r = requests.get(
        API,
        params=params,
        headers={"Authorization": f"Bearer {os.environ['BUSYSMS_API_KEY']}"},
        timeout=timeout_ms / 1000 + 15,
    )
    r.raise_for_status()
    code = r.json()["code"]
    if not code:
        raise TimeoutError("No new SMS code arrived in time")
    return code

import { test, expect } from "@playwright/test";
import { waitForSmsCode } from "./busysms";

test("signs in with SMS two-factor", async ({ page }) => {
  test.setTimeout(120_000); // the default 30 s is shorter than an SMS wait

  await page.goto("https://staging.example.com/login");
  await page.getByLabel("Phone number").fill("+44 7700 900123");

  // Start waiting BEFORE the SMS is sent, then trigger it.
  const code = waitForSmsCode({ phone: "447700900123" });
  await page.getByRole("button", { name: "Send code" }).click();

  await page.getByLabel("Verification code").fill(await code);
  await page.getByRole("button", { name: "Verify" }).click();
  await expect(page).toHaveURL(/dashboard/);
});

from concurrent.futures import ThreadPoolExecutor

from selenium import webdriver
from selenium.webdriver.common.by import By

from busysms import wait_for_sms_code

driver = webdriver.Chrome()
driver.get("https://staging.example.com/login")
driver.find_element(By.NAME, "phone").send_keys("+44 7700 900123")

with ThreadPoolExecutor(max_workers=1) as pool:
    # Start waiting first, then trigger the SMS.
    pending = pool.submit(wait_for_sms_code, phone="447700900123")
    driver.find_element(By.CSS_SELECTOR, "button[type=submit]").click()
    code = pending.result()

driver.find_element(By.NAME, "otp").send_keys(code)
driver.find_element(By.CSS_SELECTOR, "button[type=submit]").click()

import { defineConfig } from "cypress";

export default defineConfig({
  e2e: {
    setupNodeEvents(on) {
      on("task", {
        // Runs in Node, so the API key never reaches the browser.
        async waitForSmsCode({ phone }: { phone: string }) {
          const params = new URLSearchParams({ phone, timeoutMs: "60000" });
          const res = await fetch(`https://busysms.net/api/v1/codes?${params}`, {
            headers: { Authorization: `Bearer ${process.env.BUSYSMS_API_KEY}` },
          });
          if (!res.ok) throw new Error(`BusySMS ${res.status}`);
          const { code } = await res.json();
          return code; // null if nothing new arrived
        },
      });
    },
  },
});

it("signs in with SMS two-factor", () => {
  cy.visit("https://staging.example.com/login");
  cy.get("input[name=phone]").type("+44 7700 900123");
  cy.contains("button", "Send code").click();

  cy.task("waitForSmsCode", { phone: "447700900123" }, { timeout: 90_000 }).then((code) => {
    expect(code, "SMS code").to.be.a("string");
    cy.get("input[name=otp]").type(String(code));
  });
  cy.contains("button", "Verify").click();
});

# Start waiting in the background, then trigger the SMS
curl -s -H "Authorization: Bearer $BUSYSMS_API_KEY" \
  "https://busysms.net/api/v1/codes?phone=447700900123&timeoutMs=60000" > code.json &
WAIT_PID=$!

./trigger-login.sh   # whatever makes the service send the SMS

wait "$WAIT_PID"
CODE=$(jq -r .code code.json)
[ "$CODE" != "null" ] || { echo "No SMS code arrived" >&2; exit 1; }
echo "Got code $CODE"