{
  "id": 7376377,
  "title": "Fill an SMS Verification Code Without Reading the Inbox",
  "url": "https://urgent.news/2026/09/14/fill-an-sms-verification-code-without-reading-the-inbox",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T18:47:29.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/codenameone/fill-an-sms-verification-code-without-reading-the-inbox-926"
  },
  "original_language": "en",
  "account": "A software framework named Codename One now offers a feature to fill an SMS verification code without requiring access to the entire inbox. This feature, part of commit PR #5642, includes a country-aware phone-number field and a complete verification component. Both iOS and Android can provide the code using their secure autofill paths, while the browser handles it via autofill. The application only receives the verification code, never the rest of the inbox. The PhoneVerification class manages phone entry, code entry, resend timing, and two server calls: setting a code sender and verifying a code. The component manages its own screen state while the application handles network and account policies. Code cannot dictate the code's validity period or session creation. The server must rate-limit requests and expire codes after verification. Autofill improves entry but does not handle security policies. Applications can add the field to existing forms using a new input constraint. The visual OTP component now uses a single editor for all six digits, eliminating six independent native editors. This design change ensures the value is stored and modified correctly. Autofill gives applications the intended value without exposing sensitive data like the user's inbox. Older Android OTP examples that requested SMS access to scan the inbox are no longer necessary. The Contact Picker returns chosen fields without exposing the address book. The framework now grants only the necessary permissions to each service, preventing unnecessary data accumulation. This design approach, known as \"secure-by-default,\" minimizes data exposure and reduces the attack surface.",
  "summary": "A six-digit text field should not need access to every message on a phone. What is Codename One? Codename One is an open-source framework for building native iOS, Android, desktop, and web apps from a single Java or Kotlin codebase. Learn more at codenameone.com . PR #5642 adds one-time-code autofill, a country-aware phone-number field, and a complete verification component. iOS, Android, and the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}