---
schema_version: "1"
id: 5d0e9a50b08975c24892a9d436ad7634e620e7fb1bc5ec32a75c5afe6c2ce7d0
title: Custom One-Time Password Delivery Process
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/custom_otp_provider_how_it_works.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.custom_otp_provider_how_it_works.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9889decd67a0c5aa7e13cf59adb2685f5b0e4d9ec9c556df7c807b3d750224cd
description: If you use a custom one-time password (OTP) delivery provider instead of the Salesforce default provider, your provider sends OTP messages to end users.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Custom One-Time Password Delivery Process

If you use a custom one-time password (OTP) delivery provider instead of the Salesforce default provider, your provider sends OTP messages to end users.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

Custom OTP delivery relies on an Apex handler that implements the `Auth.CustomOneTimePasswordDeliveryHandler` interface. The interface uses the `sendOneTimePassword` method, where you pass in multiple parameters, including the OTP generated by Salesforce, the user's phone number, the user ID, and the Experience Cloud site ID, among other parameters. You can use custom code to compose the content of the message. To send the message, your handler makes an API callout to a messaging endpoint that's hosted on the provider then handles the response.

This process can begin whenever you require an external user to verify their identity using SMS. The entry point depends on your use case. These use cases support identity verification with SMS.

- [Multi-factor authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_overview_2fa.htm&type=5&language=en_US)
- [Passwordless login](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_passwordless_login_use_cases.htm&type=5&language=en_US)
- [Passwordless registration](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_passwordless_login_discovery_parent.htm&type=5&language=en_US)
- [Self-registration](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_self_registration_use_cases.htm&type=5&language=en_US)
- [Headless passwordless login](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_flows_parent.htm&type=5&language=en_US)
- [Headless passwordless registration](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_flows_parent.htm&type=5&language=en_US)

For example, if you use passwordless login, this flow can begin when a user goes to your Experience Cloud site login page and enters their phone number to log in.

1. Salesforce calls the `sendOneTimePassword` method in the custom OTP delivery Apex handler.
2. Your Apex implementation uses the `sendOneTimePassword` method to send an authenticated request to the provider's callout endpoint. The request includes the user's ID, their phone number, the message content, the Salesforce OTP, and any other parameters that the provider requires.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note Your Apex implementation is responsible for connecting to the provider and delivering the SMS message. Salesforce doesn't provide this functionality by default.
3. The provider returns a response, which your Apex handler captures and processes. How you process the response depends on your provider.
4. If the response is successful, your handler returns the `Auth.CustomOneTimePasswordDeliveryResult` enum value `SUCCESS`.
5. The provider sends an OTP to the user's phone number.
6. The user enters the OTP in your Experience Cloud site verification form.
7. Salesforce verifies the OTP. This step depends on your use case. For example, for passwordless login, you can use the `verifyPasswordlessLogin` method in the [`System.UserManagement`](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_UserManagement.htm) class.
8. The user's identity is logged in or registered, depending on your use case.