What is the SMS Retriever API in Android?

The SMS Retriever API lets your app automatically read a one-time verification code from an incoming SMS, without asking the user for the READ_SMS or RECEIVE_SMS permission.

That permission-free part is the whole point. Reading arbitrary SMS content is a serious privacy grant, Play Store policy restricts it heavily, and users are rightly wary of an app asking for it just to autofill an OTP. The SMS Retriever API sidesteps that entirely, using an app-specific hash instead of a broad permission.

The flow looks like this.

• Your app starts listening by calling SmsRetriever.getClient(context).startSmsRetriever().
• The verification SMS your backend sends must include an 11-character hash at the end of the message, computed from your app's package name and signing certificate.
• When a message carrying that exact hash arrives, Google Play services delivers its content to your app through a broadcast, matched only by the hash, without your app ever being granted general SMS read access.
• Your app extracts the code from the message text, typically with a regex, and fills it in automatically.

The tradeoffs worth naming. It only works for messages formatted with that specific hash suffix, so it's opt-in on the backend, you can't retrofit it onto an existing SMS format without changing what you send. And the listener times out after five minutes, so it's meant for the "waiting on this screen right now" case, not a general-purpose SMS reader. Given those constraints, it's the correct default for OTP autofill, the alternative of requesting RECEIVE_SMS for the same job is a permission most users would rightly decline.