10DLC OTP API: Send SMS Verification Codes in the USA Compliantly (2026)

Sending OTP via SMS to US mobile numbers in 2026 means dealing with 10DLC. There is no longer a way around it; application-to-person SMS on long codes requires brand and campaign registration through The Campaign Registry, with associated fees, throughput limits, and carrier-level enforcement. This guide walks through what 10DLC is, why it exists, how the registration works, what it costs, what your throughput will look like, and how to deploy a 10DLC-compliant OTP API in the US without burning four to six weeks waiting on registration.

What is 10DLC and Why Does It Matter for OTP?

10DLC stands for "10-digit long code" — the standard format for application-to-person (A2P) SMS messaging on standard US mobile numbers. Before 10DLC, businesses sent A2P SMS through person-to-person long codes that were never designed for high-volume application use. Carriers tolerated it for a long time. By 2021, they didn't.

The 10DLC framework, formalized by The Campaign Registry (TCR) and enforced by all major US carriers (T-Mobile, AT&T, Verizon, US Cellular), requires every business sending A2P SMS, including OTP and verification messages, to register both their brand and the specific use case (campaign) they're sending. Unregistered traffic is filtered or blocked by carriers, with delivery rates dropping to single digits within weeks of non-compliance.

The FCC's 10DLC framework is the regulatory backdrop, and TCPA enforcement sits on top of it as a separate consumer-protection layer. For OTP traffic specifically, the relevant campaign category is "2FA" or "Low-Volume Mixed" depending on volume.

The 10DLC Registration Process

Every brand sending OTP SMS to US numbers needs to complete a four-step registration:

Step 1: Brand registration

‍You submit your business legal name, EIN (or DUNS number), industry vertical, and contact information to The Campaign Registry through your CPaaS provider. TCR vets the brand against external databases and assigns a "trust score" that determines your throughput cap. The trust score is reviewable but not appealable in real time. Cost: ~$4 one-time fee.

Step 2: Campaign registration

‍For each use case (OTP/2FA, marketing, customer care, etc.), you register a campaign with sample message content, opt-in flow description, and expected monthly volume. OTP campaigns typically clear faster than marketing campaigns because the use case is well-understood. Cost: ~$10 one-time fee plus $1.50–$10 per month per campaign depending on tier.

Step 3: Campaign approval and provisioning

‍Mobile carriers review the campaign individually. T-Mobile typically approves in 1–3 days, AT&T and Verizon in 5–10 business days. Once approved, your provider provisions the campaign on your assigned long codes and you can start sending.

Step 4: Throughput allocation

‍Each campaign gets a per-second throughput cap based on brand trust score and campaign tier. Standard 2FA campaigns from medium-trust brands typically clear 75–100 messages per second per long code, with the option to add additional long codes for parallel throughput.

End-to-end, a self-managed 10DLC registration takes 4–6 weeks for most teams. Some providers (notably VerifyNow and Bandwidth) handle the entire registration in-house as part of their onboarding, compressing the timeline to days.

10DLC vs Short Codes vs Toll-Free Numbers for OTP

Three options exist for sending OTP SMS to US numbers. Each has trade-offs:

10DLC long codeShort code (5–6 digits)Toll-free (8XX)Setup time4–6 weeks self-managed; days with managed providers8–12 weeks2–4 weeks (verification process)Setup cost$10–$15 one-time$1,000–$1,500/month leased~$10/month + verification feePer-message cost$0.0079–$0.012 + carrier fees$0.005–$0.008 + carrier fees$0.0079–$0.012 + carrier feesThroughput75–225 MPS per number per tier100–500+ MPS3 MPS typicalBest forMost OTP use cases under 1M/monthVery high volume / brand-recognizable shortcodesCustomer service, low-volume 2FA

For most US OTP workloads in 2026, 10DLC is the right answer. Short codes are overkill for most use cases and require quarterly carrier reviews. Toll-free numbers are too slow for high-volume OTP throughput.

10DLC Throughput Limits for OTP Senders

Throughput on 10DLC is tier-based. For OTP/2FA campaigns in the US specifically, the tiers map roughly as:

• Tier 1 (Sole Proprietor): 75 message segments per second, capped at 1,000 segments/day per carrier. Limiting for any real OTP volume — only useful for very small businesses.
• Tier 2 (Low Volume Standard): 75 MPS per long code, no daily cap. Adequate for most OTP workloads up to ~100K/day.
• Tier 3 (Standard / Medium): 225 MPS per long code. Sufficient for 1M+/month workloads on a single number.
• Tier 4 (High Volume / Large): 4,500+ MPS aggregated across multiple numbers. Reserved for enterprise senders with proven track record.

Trust score (set by TCR during brand registration) determines initial tier. If your trust score lands you at Tier 1 when you need Tier 2 or 3, the path is to provide additional documentation (financial info, marketing presence) and re-submit for re-vetting.

10DLC Pricing: What It Actually Costs Per OTP

The all-in cost of a 10DLC OTP message in the US in 2026 is roughly:

Per-message cost = Base SMS rate (~$0.0079) + Carrier surcharge (~$0.0025–$0.005) + 10DLC campaign monthly fee amortized + Provider markup

For a typical 50K-OTP-per-month US workload on Tier 2, the all-in cost lands around $0.013–$0.018 per delivered SMS segment. Multi-segment messages (over 160 GSM-7 characters or 70 UCS-2) cost proportionally more. Our deep-dive on OTP API pricing in the USA models this out by provider and volume tier.

How VerifyNow Handles 10DLC for You

VerifyNow's positioning for US senders is "pre-approved 10DLC." The practical implications:

• Brand and campaign registration are completed by VerifyNow's compliance team using documentation you provide during onboarding.
• The Campaign Registry fees are absorbed in standard per-OTP pricing — no separate line items.
• First-OTP-to-production timeline is days, not weeks.
• If trust-score tier is lower than your volume needs, VerifyNow's compliance team handles the re-vetting submission.
• Carrier surcharge passthrough is itemized and capped — no surprise mid-quarter fee changes.

The trade-off versus self-registering with a thinner CPaaS like Telnyx or Plivo is that you give up some price flexibility — but for most teams whose engineering time is more valuable than the marginal per-OTP savings, it's a clear win.

Best Practices for 10DLC OTP Compliance

Use approved opt-in language

‍The user must affirmatively opt into receiving OTP messages — typically by entering their phone number and clicking a button labeled clearly ("Send verification code" or similar) on a page that discloses message rates may apply.

Keep OTP message templates within 160 GSM-7 characters where possible

‍Multi-segment messages cost more and have higher delivery failure rates on some carriers.

Include a brand identifier and "Reply STOP" footer

‍Even though OTP messages are typically transactional and exempt from many marketing-style requirements, including a brand identifier and stop-keyword honors carrier filtering preferences and reduces filtering risk.

Honor STOP requests programmatically

‍When a user replies STOP, your system must not send further messages from any campaign to that number. Most CPaaS providers handle this automatically, but verify it does in your testing.

Layer TCPA compliance on top of 10DLC

‍10DLC handles the carrier-side rules. The TCPA handles the consumer-protection-side rules. They're separate and both apply.

FAQs

Is 10DLC mandatory for OTP SMS in the USA in 2026?‍

Yes, for any application-to-person SMS to US mobile numbers on long codes. Unregistered traffic is filtered or blocked by all major US carriers. The only alternatives are short codes (slower setup, higher cost) or toll-free numbers (lower throughput). For most OTP use cases, 10DLC is the right path.

How long does 10DLC registration take?‍

Self-managed: typically 4–6 weeks end-to-end (brand vetting + campaign approval + carrier provisioning). Provider-managed: days, depending on the provider. VerifyNow and Bandwidth are the two major providers offering full in-house 10DLC handling.

What's my expected throughput on 10DLC for OTP?‍

For Tier 2 (low-volume standard) brands, expect 75 message segments per second per long code, scaling to 225 MPS at Tier 3 and 4,500+ MPS at Tier 4. For most OTP workloads under 250K/month, a single Tier 2 long code is sufficient.

Skip the _10DLC Wait — Ship OTP in a Day

If 10DLC registration is the only thing standing between you and a US OTP launch, consider a provider that handles it for you. VerifyNow for USA includes 10DLC brand and campaign registration as part of standard onboarding — most teams send their first verified OTP within a day, not a month and a half.