SM-DP+ Address and Activation Code: What Each Field Does

An eSIM QR code holds two things: the domain name of a server, and a reference number for the profile that server has prepared for you. The server is the SM-DP+, the reference is the activation code, and between them they are the whole of what a scan transfers. The profile itself is downloaded afterwards, over the internet, from that address.

That is worth knowing because it explains every error message in this subject. A wrong address means your phone could not find the shop; a wrong or spent code means the shop could not find the order.

The format is not a provider’s invention. It is Table 8 of the GSMA’s SGP.22 remote provisioning specification, which is why the same two fields work on every phone that supports eSIM. Fields are separated by a dollar sign, and a complete code reads like this: 1$SMDP.GSMA.COM$04386-AGYFT-A74Y8-3F815.

• The leading 1 is the format version. A device is required to treat anything other than 1 as invalid, so it is not a field you ever edit.
• The SM-DP+ address is a fully qualified domain name. It looks like a website because it is one: your phone resolves it and connects to it.
• The activation code token, which the specification calls the Matching ID, identifies the specific order. Upper case letters, digits and hyphens only.
• An optional server identifier, rarely present, which pins the certificate the server must present.
• An optional flag set to 1 when a separate confirmation code will also be required.

The whole thing is capped at 255 characters. When it is printed in a QR code rather than typed, the specification requires the prefix LPA: in front of it, which is why a decoded code begins LPA:1$ and a code you type by hand does not.

Subscription Manager Data Preparation, with a plus for the consumer version of the architecture. It is the machine that holds prepared profiles: an operator tells it to make one, it stores it encrypted, and it releases it only to an eUICC that authenticates itself. Your provider may run its own or rent space on somebody else’s, which is why two unrelated brands can hand you addresses at the same domain.

The software on your side is the LPA, the Local Profile Assistant, built into iOS and Android. It reads the code, calls the address, proves the chip is genuine and installs what comes back. None of it is visible, and how the download and the chip fit together is the longer version of the same story.

It is not a password and it is not your subscriber identity. It is a matching reference agreed between the operator and the server when the order was placed, and the specification requires the server to process only codes it already knows about. That single rule explains most of what people meet:

• A mistyped code is rejected immediately rather than after a download, because the server has nothing under that reference.
• A code that has already been installed is spent. Retrying it gets an error, and the fix is a reissue from the provider rather than a second attempt.
• Codes contain no lower case letters. If you are reading one off a photograph and cannot tell an O from a 0, the character set is a real clue.
• A confirmation code, where the flag is set, arrives separately and is the provider’s way of proving the buyer and the installer are the same person.

If you are typing rather than scanning, the walkthrough for both platforms is in installing an eSIM without scanning a QR code.

A growing share of eSIMs never show you either string. Apple lists several routes that skip them, including carrier activation, where the operator pushes the profile to a phone it already knows about, and transfers from another handset. Its own summary of the platform is a useful count of how far this has gone: an iPhone can hold eight or more eSIMs and switch between them in Settings, with the codes long since consumed.

There is also a discovery service in the specification, so a phone can ask a well known address whether anyone has a profile waiting for it and be pointed at the right SM-DP+ without a code being typed anywhere. When a provider says the eSIM will "appear", that is usually what is happening.

Because the delivery method is a property of the plan, and it is one of the few you can check before paying. A provider that gives you the address and the code in writing can be installed from a printout, on a phone with no camera access, on a plane. One that only supports its own app leaves you dependent on reaching that app from wherever you land, which is not always somewhere you can.

That is a real difference between otherwise identical plans. Compare plans for your destination with the same eye you would give the price: the cheapest gigabyte is no use if it will not install at the gate.