How-to · 4 min read
2FA testing with virtual numbers
Test SMS two-factor flows end-to-end in CI using disposable numbers and a programmatic OTP read.
If your app sends an SMS 2FA code, you can test the whole flow — enrol, challenge, verify — without a physical phone.
Pattern
- Buy a number, enrol it as the user's 2FA method.
- Trigger the challenge.
- Read the code from the API and submit it.
- Assert the protected route is now reachable.
const order = await eveses.orders.create({ country: 'ua', mode: 'activation', service: 'yourapp' });
await enrol2fa(order.phone);
await triggerChallenge();
const code = await poll(() => eveses.orders.sms(order.order_id).then(o => o.sms?.[0]?.otp));
await submit2fa(code);
await eveses.orders.finish(order.order_id);
Run it on every PR. With refunds for misses, flaky runs don't cost you, and you catch 2FA regressions before users do.
Ready to build? Create a free Eveses account, top up a wallet, and grab your API key — no KYC. See the API docs or live pricing.
FAQ
▸Can I test SMS 2FA automatically?
Yes — enrol a virtual number as the 2FA method, trigger the challenge, and read the code from the API to submit it, all in CI.
Related guides