ComposeOtpVerify

What it is

A small Compose helper that wires up Google's SMS Retriever API end-to-end so an incoming OTP SMS is auto-detected and pushed into your code-input field — no READ_SMS permission, no manual paste.

Highlights

• Compose-first API. A single composable hook plus a callback — drop into any auth screen.
• No READ_SMS permission. Uses the SMS Retriever flow, so users never see a permissions dialog.
• App-hash aware. Includes a small util to print the 11-character app hash you need at the end of the SMS body.
• Tested. Receiver lifecycle, double-fire guard, and timeout handling are all covered.

The plumbing for SMS Retriever is fiddly enough that I keep coming back to this when starting a new auth flow.