Where your GitHub verification code comes from
GitHub accounts are created with an email address. The sign-up flow sends a code to that inbox, and you cannot finish without it. If you sign in from a new browser and do not have two-factor turned on, GitHub may email a device verification code as well.
Two-factor changes the flow. With an authenticator app, you type a code from the app. With a passkey or security key, you approve the sign-in on your device. With GitHub Mobile, you approve on your phone. Only if you chose SMS does GitHub send a text, and SMS is not offered in every country.
GitHub requires two-factor for many accounts that contribute code, so a lot of developers meet this setup screen for the first time and start looking for a number.
GitHub not sending verification code
For email codes, check spam and filters, and confirm you are checking the primary email on the account. Company mail systems sometimes hold messages from new senders, so ask your admin if codes never reach a work address.
For SMS codes, confirm the number and country in your two-factor settings. Carriers can delay or drop automated texts. If SMS keeps failing, take it as a sign to move to an authenticator app or a passkey, which do not rely on a phone network at all.
If you have lost your two-factor method, use the recovery codes you saved when you turned it on. GitHub's options for getting back in without them are limited by design, so store them somewhere safe.
Never use a temporary number for GitHub two-factor
Your GitHub account can push code, read private repositories, change organization settings and hold access tokens. Anyone who can sign in as you can do the same. Two-factor is what stops a leaked password from turning into a leaked codebase.
A free shared number has a public inbox, so your codes would be readable by strangers. A per-code number is private but temporary: once the order ends, the next code goes to a number you cannot read, and you are locked out. Neither belongs on GitHub.
Authenticator apps and passkeys are stronger than SMS anyway. If you want a phone as a fallback, use your own number or a long-term private rental you keep, and treat it as a backup, not your main method.
SMS API on GitHub: receiving real SMS in tests and CI
Many people searching for an SMS API on GitHub are developers who need to receive real texts in automated tests: sign-up flows, OTP screens and phone verification in their own apps. Mocking the SMS provider covers unit tests, but an end-to-end check needs a real number and a real message.
ASMS.ai has a REST API and a native MCP server for this. With one API key and wallet billing, your test can request a private number, wait for the SMS and read the code, from $0.50 per code. If no code arrives, the order is refunded automatically, so a flaky run does not cost you.
Keep the API key in your CI secret store, such as repository or environment secrets, never in the code itself. Run SMS steps where they add value, such as a nightly end-to-end job, rather than on every push.
Anonymous SMS projects and the MCP server
Searches for anonymous SMS on GitHub often lead to scripts that scrape public number sites. Those inboxes are shared, so they suit throwaway experiments but not real accounts or private data.
The MCP server lets an AI agent request a number and read the code as a tool call, which helps when an agent runs through your own app's sign-up flow during testing. The same rules apply: test your own services and respect the terms of any platform you touch.
For a stable number that a staging account re-verifies with, a private rental from $4.99 keeps the same number for 1 day up to 12 months depending on the country, with unlimited SMS.