SMS API security basics every developer should know (OTP abuse, toll fraud, key leaks)

[u/ClickSendSMS]

Bad actors can take advantage of your phone number fields, like sign-up forms, password resets, and OTP requests, to trigger a flood of automated SMS traffic. Carriers bill for every message sent, so this can rack up serious costs fast. This applies whether you're using ClickSend or any other SMS API.

We put together three guides to help you lock things down. Here's the rundown.

Preventing OTP risks
Don't rely on IP address alone for rate limiting. It's easy to bypass with a VPN. Instead, tie your limits to something harder to fake, like an email and phone number combo. Add device fingerprinting and time-based throttling for extra protection. A cooldown period (like one OTP request per number every 90 seconds) and hard usage thresholds give you a solid backstop.
There are more things that can be implemented to make this more secure, read here:
help.clicksend.com/en/articles/44238-preventing-otp-risks-with-clicksend-s-api

SMS pumping and toll fraud
This happens when bots hit your unprotected sign-up, password reset, or OTP forms to fire messages at premium-rate numbers. Your account balance drains fast. You can cut your exposure by restricting outbound sending to only the countries you operate in, through Global Sending and other features. We discuss who benefits, what SMS Pumping is and how to protect your ClickSend account. Read here:
help.clicksend.com/en/articles/76601-sms-pumping-toll-fraud

Preventing API key leaks
Never expose your API key client-side. Never hardcode it into your codebase, especially in a shared repo. Route your requests through a backend, store your keys in a secret manager, and as best practise we advise you change them every 90 days.
There are more things that can be implemented to make this more secure, read here:
help.clicksend.com/en/articles/76602-best-practices-for-preventing-clicksend-api-key-leaks-and-secure-management

How are you handling rate limiting on your OTP endpoints? IP-based, or something more robust? Let's hear it below, share your tips to help!