Testing Sign-Up Flows With Captcha and SMS OTP

To test a sign-up flow that has both a captcha and an SMS code, use the official test keys and test phone numbers in staging, then run a small number of real end-to-end checks against production-like settings with a captcha solver and a real virtual number. Most teams only do the first half, which is why the flow breaks in production while every test stays green. This guide covers both halves, and builds on our developer guide to testing SMS OTP.

We run NumberOTP, and CaptchaNo is our partner for captcha solving. Both appear below where they fit, and we name the alternatives.

Why sign-up flows with captcha and SMS OTP break in production

They break because staging tests skip the two checks that only exist in production: a real captcha and a real SMS delivery. Teams mock both, so nobody notices when a key is rotated, a token expires before submit, or a carrier stops delivering to a number range.

• Captcha keys differ per environment. A widget wired to a test key in staging and a real key in production is two different code paths.
• Tokens expire fast. Google says a reCAPTCHA token is valid for two minutes and can be verified once, so a slow form step can fail only with real tokens.
• SMS delivery is outside your code. Your OTP provider, sender ID rules and the recipient's carrier all sit between your API call and the code arriving; our explainer on why SMS verification costs what it does covers that chain.

Step 1: test keys and test numbers in staging

For your own app in staging, use the vendors' official test credentials. They make tests fast, free and deterministic, and they are the right tool for every run of your CI suite.

Sources: Google's reCAPTCHA FAQ, Cloudflare's Turnstile testing keys and Firebase's phone authentication guide, all read in October 2026.

Use the "always fails" and "spent token" keys too. Your sign-up page should show a clear error and let the user retry, and those keys are the only cheap way to prove it does.

Step 2: real end-to-end checks before release

Before a release, and on a schedule afterwards, run a few sign-ups against an environment with real captcha keys and real SMS delivery. That is the only test that catches expired tokens, misconfigured keys and SMS routes that stopped working.

1. Load the sign-up page in Playwright or Selenium from a stable IP and user agent.
2. Get a captcha token from a solver for the page's sitekey, then submit the form within the token's lifetime.
3. Enter a real phone number from a virtual number service and wait for the code through its API.
4. Type the code, finish sign-up and assert you land on the logged-in page.
5. Record timings for the token, the SMS and the whole flow, and alert when they drift.

Keep this to your own product or a client who has authorised it in writing. Automating sign-ups on someone else's service breaks their terms and is not what this guide is for.

Choosing a captcha solver for sign-up testing

For end-to-end sign-up checks, pick a solver that bills only on success, returns the token in one request, and lets you pass your own session details. Our partner CaptchaNo is built that way; the alternatives below have their own strengths, and the full ranking with sources is in CaptchaNo's comparison of the best captcha solvers in 2026.

Pass the same proxy and user agent to the solver that your test browser uses. A token minted in a different session is a common cause of failures that look like a broken sign-up form.

Choosing a phone number for the SMS step

Use a real, carrier-issued mobile number for production checks, not a VoIP line or a public inbox number. Many sign-up forms reject VoIP ranges, and public numbers are shared with strangers who can read your codes; our comparison of VoIP and real phone numbers explains what apps check.

• Match the country you serve. Test the same country codes your users sign up with, and add one or two you plan to launch in.
• Rent for repeated runs. A scheduled check that reuses one number is easier to trace; see how rentals help developers test SMS flows.
• Read codes through an API. Polling an inbox by hand does not scale past a handful of runs.

How NumberOTP handles the SMS step

NumberOTP gives you real SIM-backed, non-VoIP numbers in 190+ countries through a REST API, routed across three independent number pools. You request a number with one call and receive the code by polling, a live event stream or a webhook. If no SMS arrives, the activation is refunded to your balance automatically, so a failed check costs nothing. The API reference and the API playground show the exact requests, and current rates are on the pricing page.

Common failures and how to fix them

When an end-to-end sign-up check fails, the cause is usually timing or session state rather than the solver or the number. Check these first.

Frequently Asked Questions

How do I test reCAPTCHA in automated tests?

In staging, use Google's reCAPTCHA v2 test site key and secret key, which make every verification pass so your tests stay deterministic. Google offers no v3 test key and recommends a separate key for test environments. For release checks against real keys, use a captcha solver and submit the token within its two-minute lifetime.

Can I test SMS OTP without sending a real SMS?

Yes, for your own app in development. Firebase lets you register up to ten fictional phone numbers with fixed codes, so no SMS is sent and no quota is used. Other providers offer similar test modes. They do not prove that real carriers deliver your messages, so add a few real end-to-end checks before each release.

Is it legal to use a captcha solver for testing?

Testing your own product, or a client's product with written permission, is a normal quality-assurance practice. Using a solver to create accounts on someone else's service usually breaks that service's terms and may break the law. Keep end-to-end checks to systems you own or are authorised to test, and keep a record of that authorisation.

Why does my captcha token work in testing but fail in production?

Test keys skip the real checks, so they pass no matter how slow or mismatched the session is. In production, the token must be fresh, used once, and often spent from the same IP and user agent that produced it. Solve right before submitting and pass the browser's proxy and user agent to the solver.

How many real end-to-end sign-up checks do I need?

A handful per release and a small scheduled run, such as once an hour or once a day per country you serve, is enough for most teams. The goal is to catch broken keys, expired tokens and failing SMS routes quickly, not to load-test sign-up, which belongs in a separate test with your own test credentials.

Run your first real sign-up check

Wire the official test keys into CI today, then add one real end-to-end run before your next release. Create a free NumberOTP account for the SMS step and get your API key, and use CaptchaNo's captcha solver API for the token.