Testing SMS in your app without a physical SIM

If you build anything with phone verification, you eventually need to see a real SMS arrive — not just mock the API response.

Typical QA loop

1. Open a country page that matches your staging environment’s allowed regions.
2. Copy a number into your app’s phone field.
3. Trigger the OTP send from your backend.
4. Watch the inbox on InstantNum for the message body your parser expects.

Things to assert in tests

• Country code normalization (+1 vs 1 vs 001)
• OTP extraction when the template changes wording
• Expiry handling if the user is slow to paste the code
• Rate limits when the same number is reused quickly

Limits for automated CI

Public inboxes are flaky under load — fine for manual QA, poor for unattended CI unless you stub the SMS gateway. For pipelines, mock the provider or use a dedicated test SIM.

Security note

Never point staging at production numbers that receive real user traffic. Public inboxes are fine for synthetic tests only.