AWS adds managed OTP generation and verification to Notify

AWS announced managed one-time passcode (OTP) verification in AWS End User Messaging Notify on October 16, 2026. According to the announcement, Notify now generates codes, delivers them and verifies recipients’ responses. Previously, developers supplied passcodes to Notify for delivery and maintained their own code-generation, storage and expiration logic. Source: AWS announcement

Configuring the code lifecycle

Developers define a notify code configuration covering code type, length, validity period and the number of attempts a recipient gets, along with templates for each delivery channel. AWS describes a two-call flow: one call sends a code through the selected channel, and another verifies the code the recipient enters. Source: AWS announcement

Delivery supports text, voice and newly added WhatsApp. AWS says the offering includes AWS phone numbers without requiring developers to set up a number, register with carriers or manage message delivery themselves. Source: AWS announcement

What changes for application teams

The engineering benefit is a narrower implementation scope. For this flow, applications can request code delivery and submit a recipient’s response for verification instead of maintaining their own generation and expiration logic.

Treat that as a reduction in OTP implementation work, not a substitute for application-level security decisions. Decide when verification is required, how to associate a successful check with the correct user or transaction, and how to protect code-request endpoints against abuse. Review code lifetimes and attempt limits as security settings, not merely messaging preferences.

Availability and rollout checks

AWS states that Notify is available in all commercial AWS Regions where AWS End User Messaging is available. Source: AWS announcement

Before rollout, confirm pricing, destination-country coverage and channel-specific regional support separately. Do not treat the regional availability statement as a guarantee that every delivery channel can reach every recipient.