What is an OTP and why send it by SMS?

An OTP is a one-time code someone has to enter alongside their password. It is valid only once and only briefly, and proves the person has the device in hand.

Why by SMS

Because it works without the user having to install anything. An app is safer, but every extra step costs you users. For an audience you cannot compel to install something, SMS is often the best that people will actually do.

What to watch

Keep the validity short — a few minutes is enough. Limit the number of attempts. State in the message what the code is for, so somebody who did not request one knows immediately that something is wrong.

The honest caveat

SMS OTP is not the most secure thing available. Anyone who can have a SIM card transferred can intercept the code. For most applications it is more than sufficient, but if you are guarding something of high value, look at an app or a key.