Facebook SMS verification for testing: one-time numbers or a line you keep

First decision: does this Facebook account need the number again?

Facebook ties a phone number to an account for more than the first sign-up, so choose your product before you order.

• One verification, then done. You are testing a sign-up flow, checking how your app behaves after Facebook Login, or confirming a localisation. A one-time number from the OTP Gateway fits; it receives a single code and then expires.
• An account that must keep logging in. A long-lived page-admin login for your own business, a shared staging account your QA team returns to every sprint, or a recovery number for a team-managed account. Facebook may send a fresh code at any of those moments, and a one-time number will no longer be yours. Use a Dedicated Virtual Number instead: available in the United States and Canada only, from $1.95/month, with inbound SMS in the dashboard and on your webhook.

The virtual numbers page lists what a dedicated line includes. Outside the US and Canada there is no self-serve long-term option.

When does Facebook send an SMS code?

Facebook uses phone verification in a few well-known places: registering with a mobile number instead of an email address, confirming a number added to an existing profile, two-factor authentication when SMS codes are chosen as the second step, and account recovery when someone is locked out. It may also ask for confirmation after an unusual login. Each of these is a separate test case worth covering if your product depends on a Facebook account.

Which countries can a virtual number for Facebook come from?

Facebook is currently routable in 199 countries. A few that teams pick often: United States, Brazil, India, Nigeria, Philippines, Germany, Mexico, Indonesia, Egypt, Turkey, Vietnam, Pakistan, France, United Kingdom, Kenya and Algeria.

The country matters. Facebook can localise language and prompts according to the number's region, so test with the market your users actually live in. An account created for a Brazilian launch should be verified with a Brazilian number, not whichever route happens to be cheapest.

How does the Facebook verification code API flow work?

Call https://otproute.com/api/v1 with a Bearer key (prefix or_live_) from the Developer console. The service id is facebook; the country id is the api_country value, for example br or ng.

1. Check GET /api/v1/prices?country=br&service=facebook for the live price and availability.
2. Create the activation: POST /api/v1/activations with {"service": "facebook", "country": "br"}.
3. Put the returned number into the Facebook phone field of your test.
4. Listen for the activation.sms_received event, or fall back to polling GET /api/v1/activations/{id} every few seconds.
5. If the test aborts, call POST /api/v1/activations/{id}/cancel.

On the webhook side, verify X-OTPRoute-Signature (t=<unix>,v1=<hex>) by computing HMAC-SHA256 of <t>.<raw body> with the endpoint secret, reject stale timestamps, and make the handler idempotent by keying on the activation id; deliveries can repeat. Accounts get 10 keys, 5 webhook endpoints and 300 requests per minute. Polling is a fine alternative for low volume. See webhook-based OTP capture for a reference handler.

Getting a Facebook code from the dashboard

Non-developers can do it by hand: open the OTP Gateway, select Facebook, select a country, check the displayed price, and order. Copy the number into Facebook, then watch the activation in the dashboard; the code appears when the SMS lands. Cancel if you change your mind, and the amount goes back to the wallet.

Why might the Facebook code not arrive?

Several things can stop it: Facebook may refuse virtual numbers for a given flow, a route may be congested,. The 20-minute window and the refund handle the money: you only pay if the code arrives, otherwise the full amount returns to your wallet automatically.

What to do next:

• let the window run its course instead of cancelling early;
• retry later, or with a different country route that still matches your test case;
• avoid re-ordering in a tight loop, which helps nobody;
• for accounts you must keep, move to a US or Canada dedicated line.

Responsible use of Facebook phone numbers

Facebook's terms expect one personal account per real person, and business presence through pages and business tools tied to real people. Use OTP Route to test your own product's verification flow, run QA on accounts your organisation owns, or protect staff's personal numbers on business logins. Do not create accounts for people who do not exist or work around restrictions Facebook has placed on an account. OTP Route is not affiliated with Facebook, the name is a trademark of its owner, and OTP Route's Acceptable Use Policy applies to every order. Pricing for both products is on the pricing page.

Frequently asked questions

Can I receive a Facebook OTP without a SIM card?

Yes, for a single verification. Order a number for the facebook service from the OTP Gateway and read the code in the dashboard or through the API.

What is the Facebook phone number price on OTP Route?

One-time codes start from $0.20 per code; the API's prices endpoint shows the exact amount for each country. Dedicated US/Canada lines start from $1.95/month.

Will Facebook accept every virtual number?

No. Facebook can refuse virtual numbers in some flows, which is why you are refunded automatically if no code arrives within 20 minutes.

Can I log back into the same Facebook account later?

Only if you still control the number. For that, use a Dedicated Virtual Number in the US or Canada rather than a one-time activation.

Is Facebook SMS verification for testing possible in a CI job?

Yes. Create activations from your pipeline, receive codes via signed webhook, and use sandbox mode on a development account to rehearse the wiring without spending.

Which country should I choose for a Facebook test?

The one your users are in. Facebook localises prompts and checks by region, so a matching country route gives the most realistic result.

Service names are trademarks of their respective owners. OTP Route is not affiliated with them. Use numbers lawfully, follow each service's terms and our Acceptable Use Policy.