Rate this page:

Thanks for rating this page!

We are always striving to improve our documentation quality, and your feedback is valuable to us. How could this documentation serve you better?

App Verification with Twilio Verify


Does your Android application need to verify users' phone numbers using a one time password (OTP)? Using the Android SMS Retriever API from Google Play Services and Twilio Verify, you can verify phone numbers without requiring a code to be typed in. Your application also won't have to ask for permission to read SMS messages.

Automating this stage in the onboarding funnel for your application could lead to happier end users, less customer support inquiries, and higher conversion rates.

Twilioとは? Twilioでは、世界中のユーザーとSMSメッセージを送受信するための、簡単に使用できるAPIを用意しています。 1回のインテグレーションで、世界中のユーザーに対してテキストメッセージを送信できます。

Twilio Verify provides a complete solution for verifying end user phone numbers that we will use to send a numeric code in a text message to the Android app. Your server application will sit in the middle, between your Android app, and Verify, so that you can verify a user's phone number after they sign up with your mobile application.

What does that integration look like to send messages? The app will send a copy of that text message to an API endpoint that you provide, and then Verify will tell your code whether or not that code matches the one that was sent. Your server application can then mark the end user as verified.


Let's get started with your first SMS Verification! There are a couple of things you will need to set up to build SMS verification into your application.


  • Android Studio (GoogleからAndroid Studioをダウンロードしてください)
  • Twilio Account - create a Twilio account here.
  • An Android phone with an active phone number that can receive SMS messages. It will also need to have Google Play Services 10.2 or above. You can check the version of Google Play Services on your phone under the Apps menu item in the Settings app. You won't be able to test with a tablet or device that does not have a phone number - this includes the Android Emulator.


Download the Server Code

To get your solution up and running, you'll need a server. We've created quick start server applications that will provide a back end for your application. Follow the directions in the README for each of these projects. When you build SMS verification into your own application, you can use the code in these repos as a starting point. If you're building a solution in Java, C#, PHP, or Python - Twilio supports these languages, but we don't have an example application for those yet. We suggest reading through the Node.js application to get a sense for how things work.


入門用のリファレンス用にGoogleが作成したサンプルアプリケーションもあります。 正しくこれを構成するには、サンプルアプリケーションのREADMEの手順に従うことが必要です。


ひとくちメモ - Androidアプリケーション内のsensitive.xml文字列値ファイルに追加するWebアプリケーションへのURLが必要になります。 これはWebアプリケーションの稼働が開始するか、クラウド上にデプロイされて初めて入手できます。 また、ngrokのようなlocalhostトンネルを使用して公開インターネット上からアクセス可能なURLを使用することもできます。




For the Node.js server, so you will need to have Node installed locally or on the server you plan to deploy too. Need to set up Node? Download an installer from the Node.js web site, or use your operating system's package manager.

Nodeのインストールにはnodeのパッケージマネージャーであるnpmがついてきます。 サーバーをダウンロードしてzipを展開した後は、コマンドラインから下記のコマンドを使用して必要となるNodeモジュールをインストールします:

npm install

If you're curious about what modules the server is using (including the Twilio Helper Library for Node), take a look at the package.json file.


You will need to have Ruby installed on your computer, either as a standalone installation, or with a Ruby version manager like rbenv.

Download the Ruby server code, and then run:

bundle install

This command installs the Ruby gems the server needs to run.


Once you have your server downloaded, you will need several configuration values. Copy the .env.example file to .env, and then fill in these values. You will need all of them for a successful installation.

設定値 概要
TWILIO_ACCOUNT_SID The account SID is your primary Twilio account identifier. You will be able to find this value in the Twilio Console.
TWILIO_API_KEY The Twilio SDK uses API Key and Secret pairs to make REST calls to the Twilio API. You can create a new API Key and Secret pair on the API Keys page in the Console.

TWILIO_API_SECRET APIシークレットは、APIキーとシークレットの組の生成時に一度だけ表示されるため、確実にダウンロードしてください。

This project uses Twilio Verify to send verification codes and to check their status. You will need to create a verification service in the console, and then put the service id into your .env file.

APP_HASH The Android app hash is very important, as the existence of this hash in the SMS Message is what the SMS Retriever API will look for. See Google's documentation on how to Compute your app's hash string. You can also find it under the Settings menu item in the sample application.
CLIENT_SECRET Matches the Android application to the server - you can set this in the sensitive.xml file in the sample Android application. It must match the server's config value.
COUNTRY_CODE Twilio Verify requires E.164 formatted phone numbers. This project uses Twilio Lookup to convert phone numbers into the expected format, based on the country for the phone number (Example: US). Find your ISO country codes here



Run the application using the npm start command.

npm start

アプリケーションは http://localhost:3000/ で実行されるはずです。


Run the server with the following command:

bundle exec rackup

アプリケーションは http://localhost:3000/ で実行されるはずです。


お使いの携帯電話はlocalhostに直接アクセスできません。 HTTP/HTTPSのトラフィックをlocalhostで実行されているサーバーに送信するngrokのようなツールを使用して、公開インターネット上からアクセスできるURLが必要になります。 Web接続がTwilioのアクセストークンを取得できるようになるよう、HTTPSを使用します。

ngrok http 3000

Another alternative is to deploy this server to the cloud (such as Google App Engine) - you will need to configure the environment variables used above for your cloud provider.

SMS Reciever APIの、Androidアプリケーションへのインテグレーション

You'll also probably need to integrate the SMS Retriever API into your existing Android application, either by replacing your existing verification process, or adding it as a new step. Check out Google's guide for how to Request SMS Verification in an Android App.


The sample Android application also needs to be configured to communicate with your server. Make sure you have an externally accessible URL for your application first (not localhost). If you need to create an external URL for your server application running on your local computer, download and install ngrok.

Go ahead and open up the application in Android Studio, and then create a sensitive.xml file in the res/values folder.

In the sensitive.xml file, add these values - you will need to replace your-server.com in the below code snippet with your server's domain name or IP address.

<?xml version="1.0" encoding="utf-8"?>
    <string name="server_client_secret">0000000000</string>
    <string name="server_client_secret_v8">0000000000</string>
    <string name="url_verify">https://your-server.com/api/verify</string>
    <string name="url_request">https://your-server.com/api/request</string>
    <string name="url_reset">https://your-server.com/api/reset</string>

You will also need to find and edit the server client secret lines in the sensitive.xml file. Make the secret the same string that you configured on the server.

Although you configure a reset URL for the sample Android application, Twilio Verify does not have a reset feature. The endpoint is there in our sample Node.js or Ruby application, but it does not do anything. After a successful verification with Verify, you can ask for another verification for the same phone number, so you do not need to reset for testing.

Running the Android App

セットアップがすべて完了したら、Android Studio上でアプリケーションをビルドして、お使いの電話機で実行しましょう!

Double check that the App Hash (In the menu, under Settings) matches the value you have in the .env file for your server - if it's different, go ahead and change it in .env and restart the server.

Press the Sign Up button at the bottom of the app to get started with the verification process. On the next screen, when you tap the edit text input for the phone number, the Android app will use the hint picker to detect your phone's number, and then offer to fill that in for you.

Android SMS検証アプリケーション 1

Submit(送信)ボタンをクリック後、アプリケーションはサーバーにHTTP POSTリクエストを送信し、それから画面上にプログレスインジケーターが表示され、進行状況を示すトースト(情報通知用のポップアップ)がいくつか表示されます。 アプリケーションが接続に失敗した場合は、Androidアプリケーションのstrings.xmlファイル内のURLが正しいか確認してください。

Android検証アプリケーション 2


The Android application sends an HTTP POST to the server with an application secret (that the app and the server both share) and a phone number to verify.

The server then sends the phone number to Twilio Lookup, to return an E.164 formatted phone number - for instance, turning 555-555-1212 to +15555551212.

After getting a formatted phone number, the server uses the Twilio REST API to tell Twilio Verify to send a verification request to that number, with the Android app hash you provided in the .env file.

The app hash is required so that the Android SMS Retriever API can look up SMS messages specifically for that application. If you specify the app hash, Twilio Verify includes the SMS Retriver API-specific header at the beginning of the SMS:


Twilio Verify also takes care of appending the app hash to the end of the SMS message.

Sample SMS message

<#>Your Android Verification Service verification code is: 885919


SMS Verification on the Android Device Never Completes

遭遇する可能性のあるもっとも一般的なエラーのひとつは、AndroidアプリケーションのパッケージシグネチャーがSMSメッセージで送信したアプリケーションハッシュと一致しないことです。 この2つが一致しない場合、Androidアプリケーションは受信ボックスからの受信SMSを読み取ることができ図、検証プロセスが完了することはありません。

Double check that App signature has for the Android app matches the hash you set in the configuration variable for the server.

SMS Message doesn't come through

Another common type of error would be that the SMS message does not come through - it never gets sent to your phone. This usually indicates that some of the configuration values in the .env file for your server are not set up correctly. Be sure to check the console logs for your server application to see if there are any runtime errors. You can also check the Twilio Debugger to see if there are any errors.


You've got everything up and running, your Android app is now verifying its phone number via Twilio Verify, and it all works together - what's next?

Application Integration

You probably need to integrate this Twilio verification code into your existing application, with one of the Twilio helper libraries.

Twilio Verify Quickstarts

If you want to work more with Twilio Verify, try one of the Twilio Verify Quickstarts. You could use these with users that register through your web site, instead of the Android app.

Kelley Robinson
Rate this page:


誰しもが一度は考える「コーディングって難しい」。そんな時は、お問い合わせフォームから質問してください。 または、Stack Overflow でTwilioタグのついた情報から欲しいものを探してみましょう。