Verify OTP Automatically In Android Without SMS Read Permission Using Xamarin.Forms

Introduction

Google is taking user privacy seriously. It has updated its Google Play Developer Policy which restricts SMS and CALL_LOG access. If your app does not require access to Call Log or SMS permissions, you must remove the permissions from your app's manifest.

For apps requesting access to the SMS or Call Log permissions, the intended and permitted uses include default SMS handling, default phone handling, or Assistant handling capability. You should only access Call Log or SMS permissions when your app falls within permitted uses and only to enable your app’s critical core functionality.

An Android App should read the SMS for some specific needs like to verify OTP. The Google Play Service has enabled Android SMS Retriever API that allows you to access the SMS messages and verify it via SMS without device permissions.

Verify OTP Automatically In Android Without SMS Read Permission Using Xamarin.Forms

Verification Message Format

You need to follow as per Google Policy to construct the verification message and send to the user device, the message should be in the following format.

No longer than 140 bytes
Begin with the prefix <#>
One-time Verification code
A special 11-character hash for your app. That Hash can be generated by the application (will explain in the following steps).

Now, we have a very good understanding of Google's new policy and message format. In this article, I will explain the following steps. It will help you to integrate Android OTP verification code auto-read using Xamarin.Forms.

Create New Xamarin Forms Application.
Add Google Play Services Auth
Create UI Design
Dependency Service
Messaging Center subscribe
ListenToSms Dependency
Broadcast Receiver
Generate Application Hash Key Helper
Demo Application

Create New Xamarin.Forms Application

In order to implement Auto-Read OTP message, let’s start creating a new Xamarin.Forms project using Visual Studio 2019 or VS for Mac. When accessing Visual Studio 2019 for Mac for the first time, you will come across a new interface for opening and creating the projects.

Open Visual Studio Mac >> Create New Project or select Open recent application.

The available templates will appear on a Mac, like below. Select Xamarin.Forms application with different mobile platforms.

Add Google Play Service NuGet Package

After clicking on the Next button, the Xamarin Project template will generate and load the solutions into the local system. We need to install Xamarin.GooglePlayServices.Auth NuGet package to our Android project for SMS Retriever API.

Right click on Android Project >> Add Nuget Package >> Select or Search “Xamarin.GooglePlayServices.Auth”>> Install the Latest version of Google play service.

Create UI Design

Create a simple UI Design with one Entry and Button Control using Xaml in Xamarin Forms library.

<?xml version="1.0" encoding="utf-8"?>
<ContentPage xmlns="http://xamarin.com/schemas/2014/forms" xmlns:x="http://schemas.microsoft.com/winfx/2009/xaml" xmlns:local="clr-namespace:ReadOTPXamarinAndroid" x:Class="ReadOTPXamarinAndroid.MainPage">
<StackLayout Padding="15" HorizontalOptions="CenterAndExpand" VerticalOptions="CenterAndExpand" BackgroundColor="White">
<Entry PlaceholderColor="Black" Placeholder="Enter OTP" x:Name="smSEntry"></Entry>
<Button Text="Wait for sms" Clicked="ImageButton_OnClicked"></Button>
</StackLayout>
</ContentPage>

The design looks like below,

Dependency Service

DependencyService allows apps to call into platform-specific functionality from shared code. This functionality enables Xamarin.Forms apps to do anything that a native app can do. We need to create an interface design that will define how you interact with platform-specific functionality. Here, reading OTP will support only Android Platform and IOS will support with Autofill so create a DependencyService interface for listening to SMS retriever. Create a new class and interface for CommonServices.

using Xamarin.Forms;
namespace ReadOTPXamarinAndroid
{
public static class CommonServices
{
public static void ListenToSmsRetriever()
{
DependencyService.Get<IListenToSmsRetriever>()?.ListenToSmsRetriever();
}
}
public interface IListenToSmsRetriever
{
void ListenToSmsRetriever();
}
}

Subscribe To Messaging Center

Xamarin.Forms MessagingCenter enables different components to communicate without having to know anything about each other besides a simple Message contract. The MessagingCenter is a static class with Subscribe and Send methods that are used throughout the solution.

Subscribe

Listen for messages with a certain signature and perform some action when they are received. Multiple subscribers can be listening to the same message.

Send

Publish a message for listeners to act upon. If no listeners have subscribed then the message is ignored.

Here, we are creating a utility for subscribing to message listener. It will help when a new message is received.

using System;
using System.Collections.Generic;
using System.Text;
using Xamarin.Forms;
namespace ReadOTPXamarinAndroid
{
public static class Utilities
{
private static readonly object cc = new object();
public static void Subscribe<TArgs>(this object subscriber, Events eventSubscribed, Action<TArgs> callBack)
{
MessagingCenter.Subscribe(subscriber, eventSubscribed.ToString(), new Action<object, TArgs>((e, a) => { callBack(a); }));
}
public static void Notify<TArgs>(Events eventNotified, TArgs argument)
{
MessagingCenter.Send(cc, eventNotified.ToString(), argument);
}
}
}

Create Enum for message Event type

using System;
namespace ReadOTPXamarinAndroid
{
public enum Events
{
SmsRecieved,
}
}

Code Behind Design View

The Code Behind adds the Subscribe message listener and if any message is received from message app with a specific format, it will get notified and read the message and assign the OTP value into the Entry Box.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Xamarin.Forms;
using Xamarin.Forms.Xaml;
namespace ReadOTPXamarinAndroid
{
public partial class MainPage : ContentPage
{
public MainPage()
{
InitializeComponent();
this.Subscribe<string>(Events.SmsRecieved, code =>
{
smSEntry.Text = code;
});
}
private void ImageButton_OnClicked(object sender, EventArgs e)
{
CommonServices.ListenToSmsRetriever();
}
}
}

ListenToSms Dependency

Let us start creating a dependency on the Android project. If you have not added Xamarin.GooglePlayServices.Auth NuGet package, try to add it before going to create the instance.

Get an instance of SmsRetrieverClient, used to start listening for a matching SMS message.

SmsRetrieverClient client = SmsRetriever.GetClient(Application.Context);

Starts SmsRetriever, which waits for ONE matching SMS message until timeout (5 minutes). The matching SMS message will be sent via a Broadcast Intent .

var task = client.StartSmsRetriever();

Listen to the success/failure of the Start task.

using Java.Lang;
using ReadOTPXamarinAndroid.Droid;
using Application = Android.App.Application;
[assembly: Dependency(typeof(ListenToSms))]
namespace ReadOTPXamarinAndroid.Droid
{
public class ListenToSms : IListenToSmsRetriever
{
public void ListenToSmsRetriever()
{
SmsRetrieverClient client = SmsRetriever.GetClient(Application.Context);
var task = client.StartSmsRetriever();
task.AddOnSuccessListener(new SuccessListener());
task.AddOnFailureListener(new FailureListener());
}
private class SuccessListener : Object, IOnSuccessListener
{
public void OnSuccess(Object result)
{
}
}
private class FailureListener : Object, IOnFailureListener
{
public void OnFailure(Exception e)
{
}
}
}
}

Broadcast Receiver

The BroadcastReceiver that will be listening to the broadcasts of the above SmsRetrieverClient.SMS Retriever API has provided us with an intent filter SmsRetriever.SmsRetrievedAction which we will use to register our BroadcastReceiver, which we’re going to name SMSBroadcastReceiver, and implement as below.

using System.Linq;
using System.Text.RegularExpressions;
using Android.App;
using Android.Content;
using Android.Gms.Common.Apis;
using Com.Google.Android.Gms.Auth.Api.Phone;
using ReadOTPXamarinAndroid;
namespace ReadOTPXamarinAndroid.Droid
{
[BroadcastReceiver(Enabled = true, Exported = true)]
[IntentFilter(new[] { SmsRetriever.SmsRetrievedAction })]
public class SmsReceiver : BroadcastReceiver
{
private static readonly string[] OtpMessageBodyKeywordSet = { "DevEnvExe Generated OTP" }; //You must define your own Keywords
public override void OnReceive(Context context, Intent intent)
{
try
{
if (intent.Action != SmsRetriever.SmsRetrievedAction) return;
var bundle = intent.Extras;
if (bundle == null) return;
var status = (Statuses)bundle.Get(SmsRetriever.ExtraStatus);
switch (status.StatusCode)
{
case CommonStatusCodes.Success:
var message = (string)bundle.Get(SmsRetriever.ExtraSmsMessage);
var foundKeyword = OtpMessageBodyKeywordSet.Any(k => message.Contains(k));
if (!foundKeyword) return;
var code = ExtractNumber(message);
Utilities.Notify(Events.SmsRecieved, code);
break;
case CommonStatusCodes.Timeout:
break;
}
}
catch (System.Exception)
{
// ignored
}
}
private static string ExtractNumber(string text)
{
if (string.IsNullOrEmpty(text)) return "";
var number = Regex.Match(text, @"\d+").Value;
return number;
}
}
}

We have done design and coding, you can follow the below steps for generating Application hash key as per SMS Format rule.

Generate Application Hash Key Helper

The hash string is made of your app’s package name and your app’s public key certificate. To generate the hash code, just run the following C# Method to generate a hash to be included in your SMS message.

You need to make sure you generate a hash key and append to the OTP message. Without the correct hash, your app won't receive the message callback.

The hash key will generate once per app and stored. Then, you can remove this helper class from your code and create a new class into the native Android project.

using System;
using System.Linq;
using System.Text;
using Android.Content;
using Android.Content.PM;
using Android.Util;
using Java.Security;
using Java.Util;
namespace ReadOTPXamarinAndroid.Droid.Helper
{
public class AppHashKeyHelper
{
private static string HASH_TYPE = "SHA-256";
private static int NUM_HASHED_BYTES = 9;
private static int NUM_BASE64_CHAR = 11;
/// <summary>
/// Retrieve the app signed package signature
/// known as signed keystore file hex string
/// </summary>
/// <param name="context"></param>
/// <returns></returns>
private static string GetPackageSignature(Context context)
{
PackageManager packageManager = context.PackageManager;
var signatures = packageManager.GetPackageInfo(context.PackageName, PackageInfoFlags.Signatures).Signatures;
return signatures.First().ToCharsString();
}
/// <summary>
/// Gets the app hash key.
/// </summary>
/// <returns>The app hash key.</returns>
/// <param name="context">Android app Context.</param>
public static string GetAppHashKey(Context context)
{
string keystoreHexSignature = GetPackageSignature(context);
String appInfo = context.PackageName + " " + keystoreHexSignature;
try
{
MessageDigest messageDigest = MessageDigest.GetInstance(HASH_TYPE);
messageDigest.Update(Encoding.UTF8.GetBytes(appInfo));
byte[] hashSignature = messageDigest.Digest();
hashSignature = Arrays.CopyOfRange(hashSignature, 0, NUM_HASHED_BYTES);
String base64Hash = Android.Util.Base64.EncodeToString(hashSignature, Base64Flags.NoPadding | Base64Flags.NoWrap);
base64Hash = base64Hash.Substring(0, NUM_BASE64_CHAR);
return base64Hash;
}
catch (NoSuchAlgorithmException e)
{
return null;
}
}
}
}

You can call the GetAppHashkey method into MainActivity and debug the solution and get the hash key value.

Demo and Download Source Code

The Application is ready now and you can also download the source code from GitHub, start the application using Android Emulator and click Phone icon from extended controls and add the message as per follow format with the hash key.

Summary

In this article, you learned about how to verify OTP Automatically in Android without SMS read permission using Xamarin Forms. I hope this article will help you. Please leave your feedback/query using the comments box, and if you like this article, please share it with your friends.

12 Comments

Join the conversation! Your thoughts help the community grow.

Luis Salas5y ago
Hello Mr. is it possible to receive a sms code OTP and auto-detect it on a cloned App? for example a Bank app requires the sms otp code be automatically detected, there is no option to input manually and it works on original app, but not in cloned app. I'm willing to pay if you can help me with this issue, thank you.
Hasan Shaddad5y ago
@Suthahar Jegatheesan I have a simple question where are you using the SmsReceiver class? I've downloaded the project from github and it launches normally however when I press the wait for sms button the timer doesn't show up and nothing happens. After debugging and tracing the code I figured that the SmsReceiver class isn't called and I guess it's responsible for retrieving the number am I right? Thanks in advance.
- Suthahar Jegatheesan5y ago
  Hasan Shaddad Did you updated GetAppHashkey, this may issue, Can you check did you followed Generate Application Hash Key Helper section.
Liju Daniel6y ago
Auto read is working with Debug and Release modes perfectly. But after upload a bundle to Playstore this feature is not working with the apk which download from Google Playstore.. Can you help me please......@ Suthahar J
- Suthahar Jegatheesan5y ago
  This may be because of Application Hash Key Helper. are you getting any error log
javeed 13577y ago
Https://onlinebooking.sand.telangana.gov.in/Masters/Home.aspx. I want this browser Bypass OTP
MOHAMMED Shariq7y ago
Sir i need a help from you . I am ready to pay the amount. Sir actually the otp which is being sent to my phone should be read by computer
- Suthahar Jegatheesan5y ago
  Sorry for late reply, No, it's not possible from the current approach , SMS will read on the same device
Vijay Svc17y ago
This code not working
- Suthahar Jegatheesan7y ago
  Vijay Svc1 Please share what is error and issue your getting
Logesh Palani7y ago
Nice Article :). Thank You
- Suthahar Jegatheesan7y ago
  Thanks logesh for your valuable feedback :)