# Get SMS OTP Codes Into CI and QA Automation With an iPhone

> Send SMS one-time codes from a team iPhone to your own webhook, so CI and QA runs can finish sign-in on their own. Options, setup and limits.

Last updated: 2026-10-23
Canonical HTML page: https://www.fwrdsms.com/blog/sms-otp-codes-ci-automation-iphone
Published: 2026-10-17

To get SMS one-time codes into CI or QA automation, put the SIM that receives the codes in a team iPhone, and let a Shortcuts Message automation hand each code text to Fwrd, which posts it to your own HTTPS webhook as JSON. Your CI job then reads the newest code from that endpoint and types it into the sign-in screen.

**What you need:** an iPhone on iOS 26 or later with the SIM whose number gets the codes, the Shortcuts app (it’s already on the phone), [Fwrd](https://apps.apple.com/app/apple-store/id6759069713?pt=128544281&ct=blog-otp-qa&mt=8), and a public HTTPS address your CI can read, such as a staging route or an n8n workflow. Fwrd rejects IP addresses and .local or .internal names, and sends no login header, so put a long secret in the address.

## Why are SMS codes hard to automate?

SMS codes stall CI because they land on a phone, not in your runner, until something carries each text to somewhere your pipeline can read.

Most teams writing these checks only have their own phone to receive the code. A team iPhone with Fwrd turns that phone into something your pipeline can read.

## When does a team iPhone fit?

It fits when the code has to reach a specific carrier number: a third-party service you sign in to, a staging account already tied to the company phone, or a flow that treats numbers differently by type. Twilio’s [Lookup docs](https://www.twilio.com/docs/lookup/v2-api/line-type-intelligence) (checked October 17, 2026) show that apps can tell a mobile number from a non-fixed VoIP number, which it describes as a virtual number obtained online. A SIM in a team iPhone is a real carrier number, so the code arrives as it would for a customer.

The trade-off is that one phone means one number, and it must stay on and online. The sections below cover both.

## How to send SMS codes from an iPhone to your CI

Add a Webhook destination in Fwrd that keeps only codes, then a Message automation that hands each code text to Fwrd. The [webhook guide](https://www.fwrdsms.com/guides/webhook) covers the endpoint side in full.

1. **Add a webhook in Fwrd.** Open Fwrd, tap +, and choose Webhook. Paste your endpoint’s whole HTTPS address into the Configuration field, tap Send Test Message so your endpoint sees the fields, then save with the tick.

2. **Keep only codes.** In the same destination, choose Only Some Texts under Which Texts and turn on Looks Like a Code, which keeps texts with a 4 to 8 digit code. That’s one condition, so it works on the free plan.

3. **Create a Message automation.** On iOS 27, open Shortcuts, tap Library, then Automation, then +. If you see Describe a shortcut, tap Edit. Tap Automation, then Message, change Sender to Message, and type code, or the word your service’s texts use. On iOS 26, open the Automation tab, tap +, choose Message, and type it under Message Contains.

4. **Make it run without asking.** On iOS 27, tap the arrow beside the trigger and check that Confirm Before Run is off. Under ⓘ, then Privacy, check that Allow Running When Locked is on. On iOS 26, choose Run Immediately, then tap Next and Create New Shortcut.

5. **Add Fwrd’s action.** Search for Forward and add Forward Message to All Destinations. Set its Message to Shortcut Input (on iOS 26, Shortcut Input, then Message). Tap back to save (Done on iOS 26).

6. **Read the code in CI.** Have your endpoint store each body with the time it arrived. After your run requests a code, poll for the newest text received since then and pull the digits out with a regular expression.

7. **That’s it.** New code texts now reach your endpoint on their own, with the iPhone unlocked or locked.

### What does the endpoint receive?

A POST with a JSON body holding the text exactly as it arrived, in both `content` and `text`. There’s no timestamp, so record the time on your side.

```json
{
  "content": "Your verification code is 482913",
  "text": "Your verification code is 482913"
}
```

Every attempt for the same text carries the same `Idempotency-Key` header, so you can drop repeats. If a send times out, hits a 429 or 5xx, or loses its connection, Fwrd tries again, up to twice. Any 2xx answer within 15 seconds counts as delivered, and redirects are refused. Turn on Include Who Sent It in Fwrd’s Settings and choose Sender on Fwrd’s action, and the body also gets a `sender` field, handy when several services text the same number.

## What this setup can’t do

- **One number serves one run at a time.** Parallel jobs asking for codes on the same number can read each other’s code, so queue the sign-in step or match each code to the run that asked for it.
- **The free plan covers 15 codes a month.** After that, codes stop until next month, and busy pipelines get there fast; Fwrd Pro removes the limit for $4.99 a month or $29.99 a year in the US.
- **It’s receive-only.** Fwrd can’t send a text from the iPhone for your CI.
- **The phone stays on and online.** After a restart, forwarding waits until someone unlocks it once, and an iPhone that isn’t unlocked for three days restarts itself. Keep it charged where someone can reach it.
- **Fwrd’s action reaches every active destination.** If the same phone also forwards elsewhere, use Forward Message to Destination instead and pick the webhook.
- **Only new texts.** Codes that arrived before the automation existed aren’t sent.

For people who need codes rather than pipelines, [sharing 2FA codes with your team in Slack](https://www.fwrdsms.com/blog/share-2fa-codes-with-team-slack) covers that setup.

## Questions about SMS codes in automation

### Can Selenium or Playwright read an SMS code directly?

No. Browser automation can’t see a phone’s messages. Something has to move the text off the phone first, such as a Shortcuts automation with Fwrd posting it to a webhook your script polls.

### Do the codes go through Fwrd’s servers?

No. Fwrd has no account and no server of its own; each text goes from the iPhone straight to your HTTPS endpoint, and the address stays in the iPhone’s Keychain.

### Does it work with short-code senders?

Yes. The automation matches what the text says, not who sent it, so codes from short numbers that aren’t in your Contacts still match a word like code.

### Can I use an n8n workflow as the endpoint?

Yes. Add a Webhook node set to POST, use its production URL, and publish the workflow, or it won’t answer. [Send iPhone texts to Zapier, Make or n8n](https://www.fwrdsms.com/iphone-sms-to-zapier-make-n8n) has the steps.

## Keep reading

- [Forward iPhone SMS to a webhook](https://www.fwrdsms.com/iphone-sms-to-webhook)
- [Is there an iPhone SMS API?](https://www.fwrdsms.com/blog/iphone-sms-api)