Passcode-protected SMS Bot: locking the front door without losing the customer
Verification is the cheapest security control you will ever buy and the easiest one to implement badly. The difference is entirely in the details.
- 00:00Signup attempt from a number we have never seen.
- 00:01Number checked: prepaid mobile, carrier known, not a virtual range.
- 00:03Code sent. Rate limits applied by number, account and address.
- 00:19Verified. Account created.
- 00:22Second attempt, same number, third account today. Blocked.
What it actually does
A code, push or cryptographic challenge is issued to a channel the customer controls, then checked with strict rate limits and short expiry.
Two-way text messaging that customers actually read: reminders, alerts, opt-ins, forwarding and bots. In practice, Passcode-protected SMS Bot is the version of that we deploy when a business needs the result rather than a project. The foundation is contributed by a developer in the community, which usually means it solves a real problem someone actually had. That matters more than it sounds: the failure modes have already been found by someone else, in public.
Why businesses ask for this
SMS is the highest-open-rate channel most small businesses own and the least automated. A message that fires itself at the right moment replaces a job nobody on the team enjoys doing.
The people who get the most out of it: trades, clinics, salons, gyms and anyone whose diary depends on people turning up.
- Fewer no-shows because the reminder always goes out
- Leads answered in seconds instead of hours
- A written record of every customer conversation
How we build it, step by step
The sequence below is the one we follow on every identity assurance build. It is deliberately boring, because the interesting version is the one that breaks in month three.
- Pick the primary channel by delivery rate in your actual customer base
- Set the fallback order and the retry backoff
- Rate limit by number, by account and by IP
- Log every attempt for the audit trail without logging the code itself
What we change before it goes live
A reference implementation is a starting line, not a product. Every one we deploy gets the same treatment:
- Your numbers, your sender identity and your wording, so nothing reads as generic
- Secrets moved out of the code and into managed configuration
- Retries, rate limits and idempotency, so a hiccup never sends twice
- Structured logging and alerting, so a failure is noticed by us and not by a customer
- Consent, opt-out and record-keeping built in rather than bolted on
- Source control, a staging environment and a rollback that takes a minute
Compliance and risk
Australian messaging sits under the Spam Act 2003 and the ACMA industry codes: you need consent, sender identification and a working unsubscribe on every commercial message. We wire all three in before launch.
The technical foundation
Twilio Programmable Messaging, a webhook endpoint we host, and your CRM or spreadsheet as the source of truth.
- python — Python, a good fit when the work sits next to data, scheduling or machine learning.
The open-source starting point sits here, and it stays public whether you work with us or not:
Upstream last updated 2025-05-13.
What it costs
Three ways to buy this, and the honest recommendation is usually the middle one:
- Starter build, from $2,500 — we build it, hand it over and warrant it for 30 days. Suits a business with someone technical in-house.
- Managed, from $390/mo — we build it and then own it: monitoring, changes, compliance upkeep and a monthly report. Suits everyone else.
- Platform, from $2,400/mo — when this is one of several systems and you want them designed as one layer instead of five.
Platform usage is billed at cost on top and itemised on the invoice. There is no margin on it and no minimum spend.
Common questions
How long does Passcode-protected SMS Bot take to build?
For a standard configuration, about a week from kick-off to a staging number you can test on, then a few days of live monitoring before we call it done. Anything involving a port of an existing phone number adds one to two weeks of carrier time that nobody controls.
What does it cost to run each month?
Two lines: our managed plan from from $390/mo, and platform usage billed at cost. Usage for this kind of system usually lands between $30 and $300 a month depending on volume. You see both itemised, and the platform account stays in your name.
Do we own it, or are we locked in?
You own it. The account, the numbers, the phone history and the source code are yours, and the foundation is open source. If you take it in-house, we hand over the repository and the runbook and that is the end of the conversation.
What if it breaks at 6pm on a Friday?
It is monitored. Failures raise an alert, the system degrades to something safe rather than silent, and hello@betr.agency is the inbox that answers. That is what the managed plan buys.
Can it work with the systems we already use?
Usually yes. Twilio Programmable Messaging, a webhook endpoint we host, and your CRM or spreadsheet as the source of truth. Where a system has no API, we look at whether an export, a shared inbox or a scheduled sync gets you 90 percent of the value for 10 percent of the cost.
Where to next
The product page for this build lists the specification, the timeline and what is included: Passcode-protected SMS Bot. If you want to talk it through against your actual process, a scoping call is 30 minutes and costs nothing.