--- schema_version: "1" id: 5300cdd7dfa9c34b8d3582f45da6c4fbd8dea0754ce820698079b9abcdd93dca title: Considerations for Using a Custom One-Time Password Delivery Provider collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/custom_otp_provider_considerations.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.custom_otp_provider_considerations.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 0c0a40b5803c628e425a509c461a3e7d7cadca689d4ee12bdaf59f211d7deddf description: Before you configure a custom one-time password (OTP) delivery handler to send SMS messages for Experience Cloud use cases, review these considerations. products: - Security - Cross Cloud release: "264" --- # Considerations for Using a Custom One-Time Password Delivery Provider Before you configure a custom one-time password (OTP) delivery handler to send SMS messages for Experience Cloud use cases, review these considerations. ### Required Editions
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Professional, Enterprise, Unlimited, and Developer Editions
## Security Considerations - If you use custom OTP providers, your Apex implementation has access to the OTP, which isn't the case if you use the Salesforce default provider. With a custom OTP provider, your Apex handler implementation, not Salesforce, performs identity verification. You're responsible for the security and integrity of your code and implementation. - You can choose to deliver OTPs via alternative delivery methods, such as iMessage, Rich Communication Services (RCS), and WhatsApp. Before choosing any alternative delivery methods, carefully consider the security implications. - If you send an SMS message via a custom provider, and the user's phone number isn't verified, Salesforce doesn't attempt to verify it. Salesforce can’t make sure that the OTP gets delivered to a phone number that's verified by Salesforce. As a security best practice, we recommend that you verify all phone numbers and configure your handler to send OTPs only to verified phone numbers. To understand differences in verification for custom OTP providers and the default Salesforce provider, review these tables.
Custom OTP Provider Verification
Use Case Apex System.UserManagement Methods TwoFactorMethodsInfo Verification Requirement TwoFactorMethodsInfo Post-Verification Result
User-Verified Number (HasUserVerifiedmobileNumber) Admin-Verified Number (HasVerifiedMobileNumber) User-Verified Number (HasUserVerifiedmobileNumber) Admin-Verified Number (HasVerifiedMobileNumber)
Self-registration initSelfRegistration and verifySelfRegistration Not required Unchanged true
Passwordless login initPasswordlessLogin and verifyPasswordlessLogin One of these fields must be true Unchanged true
Verification method registration Not required Unchanged true
Verification (including multi-factor authentication) initVerificationMethod and verifyVerificationMethod One of these fields must be true Unchanged true
Default OTP Provider Verification
Use Case Apex System.UserManagement TwoFactorMethodsInfo Verification Requirement TwoFactorMethodsInfo Post-Verification Result
User-Verified Number (HasUserVerifiedmobileNumber) Admin-Verified Number (HasVerifiedMobileNumber) User-Verified Number (HasUserVerifiedmobileNumber) Admin-Verified Number (HasVerifiedMobileNumber)
Self-registration initSelfRegistration and verifySelfRegistration Not required true Unchanged
Passwordless login initPasswordlessLogin and verifyPasswordlessLogin Required Not required true Unchanged
Verification method registration Not required true Unchanged
Verification (including multi-factor authentication) initVerificationMethod and verifyVerificationMethod Required Not required true Unchanged
## Other Implementation Considerations - This feature is supported only for Salesforce Customer Identity. You can't use it for internal users, also known as employees. - This feature is supported for all [Experience Cloud user licenses](https://help.salesforce.com/s/articleView?id=platform.users_license_types_external_identity.htm&type=5&language=en_US) and the [External Identity license](https://help.salesforce.com/s/articleView?id=platform.users_license_types_external_identity.htm&type=5&language=en_US). It doesn't require the [Identity Verification Credits add-on license](https://help.salesforce.com/s/articleView?id=xcloud.identity_licenses.htm&type=5&language=en_US). - Because this feature relies on a custom provider to deliver the message, Salesforce Customer Support can't troubleshoot issues with delivery. To fix delivery issues, work with your provider. - You must contact Salesforce Customer Support to use this feature. If Support gives you access to this feature, you have the option to configure a custom OTP provider for all Experience Cloud sites in your org. To keep your OTP delivery method consistent, if you request access to this feature, we recommend using a custom OTP provider for all your Experience Cloud sites. However, if you don't configure a custom OTP delivery Apex handler for a site, it continues to use the Salesforce default delivery service. - If Support gives you access to this feature, it isn't automatically enabled. To use this feature, you must add a working custom OTP delivery handler to your Experience Cloud site's settings. - If you switch to a using a custom OTP provider, we don't recommend that you switch back to the Salesforce default provider.