FortiAuthenticator SMS Gateway Setup for Two-Factor Codes
Send FortiAuthenticator token codes to your users' phones over Indian DLT routes. Add our URL API as an HTTP SMS gateway, register the token message as a DLT template, and your VPN and admin logins get SMS codes.
In FortiAuthenticator, go to System, Messaging, SMS Gateways, Create New and choose HTTP/HTTPS with the GET method. Set the API URL to our /httpapi/send endpoint and add the parameters api_key, sender_id, route=T, phonenumber={{:mobile_number}} and message={{:message}}. Register the token message as a DLT service template, then use Test Settings.
FortiAuthenticator SMS gateway settings
In FortiAuthenticator go to System, Messaging, SMS Gateways and choose Create New. Enter these values, add each parameter as a Field and Value pair, then use Test Settings.
| Field | Value |
|---|---|
Protocol | HTTP/HTTPS |
HTTP method | GET |
API URL | whitelabled.securesmsc.com/httpapi/send (no https:// and no ?) |
api_key | Your API key from the panel |
sender_id | Your approved 6-character header, such as ACMEIN |
route | T |
phonenumber | {{:mobile_number}} |
message | {{:message}} |
GET https://whitelabled.securesmsc.com/httpapi/send?api_key=YOUR_KEY&sender_id=ACMEIN&route=T&phonenumber=9812345678&message=Your%20authentication%20token%20code%20is%20482913
If the test fails
| Reply | Meaning | What to check |
|---|---|---|
-7 | Invalid API key | Copy the key again from the panel. Remove any space before or after it. |
-10 | Invalid sender ID | Use your approved header exactly, without the VM- prefix or -S suffix. |
-5 | Missing or invalid mobile number | The user has no mobile number in FortiAuthenticator, or the tag is misspelt. |
-12 | Not enough credits | Recharge, and watch your balance with /api/getcredits so token SMS never stop. |
-17 | Invalid route | Set route to T in capital letters. |
Report: PROMO NOT ALLOWED | Text does not match a DLT template | Register the exact token wording as a service template. |
No plug-in needed
FortiAuthenticator's own HTTP gateway calls our URL API directly.
Service route, any hour
Token codes go as service SMS, so they reach DND numbers at night too.
+91 numbers handled
On Indian routes the last 10 digits are used, with or without the country code.
Test in a browser first
Open the test URL in a browser to see the reply code before you save.
How FortiAuthenticator sends SMS codes
FortiAuthenticator can send a one-time token code by SMS when a user signs in to a FortiGate SSL VPN, a captive portal or an admin console. It does not send SMS itself. It calls an SMS gateway that you define, either by email to an SMS address or by an HTTP request.
Our URL API fits the HTTP option. FortiAuthenticator fills in the user's mobile number and the token message using its tags, {{:mobile_number}} and {{:message}}, and calls the URL. We deliver the SMS over a DLT service route.
The URL API replies in plain text: a broadcast ID when the SMS is accepted, or a negative code such as -7 when something is wrong. It returns HTTP status 200 in both cases, so test the URL in a browser first, and check the SMS report in our panel after your first FortiAuthenticator test.
Register the token message as a DLT template
Every SMS to an Indian number must match a template approved on your DLT portal. By default, FortiAuthenticator's message tag sends Your authentication token code is followed by the code. Register that wording as a service implicit template, with the code as a variable: Your authentication token code is {#var#}.
If you change the token message text in FortiAuthenticator, register the new wording before you switch. A message that does not match any approved template is not sent, and its report shows PROMO NOT ALLOWED. Our team can check the template with you before you submit it.
Mobile numbers and international users
Store each user's mobile number in FortiAuthenticator as you normally would. On our Indian service route, only the last 10 digits are used, so 9812345678, 919812345678 and +91 98123 45678 all reach the same phone.
If some users have mobile numbers outside India, tell us before you go live. International SMS uses a different route and is enabled on your account separately, and the sender ID rules differ by country. Keep numbers in one format inside FortiAuthenticator, so the same user is never stored twice with different spellings of one number.
Keeping two-factor login reliable
Two-factor SMS is a login dependency. If credits run out, nobody can connect to the VPN. Check your balance regularly, or call /api/getcredits from your monitoring system, and recharge well before it runs low. SMS credits stay valid for one year from purchase.
Keep a second authentication method, such as FortiToken Mobile or email codes, for administrators. Then a network problem at the user's end never locks out the people who can fix it. Check the SMS delivery report in our panel whenever a user says a code did not arrive. It shows whether the SMS was delivered, failed or rejected, and when.
How it works
Get your API key
Create an account, finish DLT registration and copy your API key from the panel.
Register the template
Add Your authentication token code is {#var#} as a service template on DLT.
Create the gateway
In FortiAuthenticator add an HTTP/HTTPS SMS gateway with the parameters on this page.
Test and set default
Use Test Settings, check the SMS on your phone, then set the gateway as default.
Frequently asked questions
How do I configure an SMS gateway in FortiAuthenticator?
Go to System, Messaging, SMS Gateways and select Create New. Choose HTTP/HTTPS, set the method to GET and enter our API URL without https:// or a query string. Add the parameters api_key, sender_id, route, phonenumber and message as Field and Value pairs, using the {{:mobile_number}} and {{:message}} tags. Then select Test Settings.
Which FortiAuthenticator tags do I use?
Use {{:mobile_number}} for the phone number and {{:message}} for the token message. FortiAuthenticator replaces them with the user's number and the text Your authentication token code is followed by the code. A {{:country_code}} tag also exists, but you do not need it for Indian numbers on our service route.
Why do token SMS show PROMO NOT ALLOWED?
The text FortiAuthenticator sent does not match any DLT template approved for your sender ID. Register the exact wording, with the code as {#var#}, as a service template on your DLT portal. If you customised the message in FortiAuthenticator, make sure the template matches the customised text, including spaces and punctuation.
Will token SMS reach numbers on DND?
Yes. Token codes are service messages, sent on route T with an approved service template, so they are delivered to DND numbers at any hour. Promotional rules and time limits do not apply to them. Use a service header, which shows the -S suffix on the user's phone.
Can I send FortiAuthenticator codes by email to SMS instead?
FortiAuthenticator supports an SMTP option that emails an SMS address, but our platform does not offer email to SMS for this. Use the HTTP/HTTPS option described on this page, which also returns a clear reply code when something is wrong.
Add SMS codes to your FortiAuthenticator
Get an API key, register the token template with our help and send your first test code today.