Compliance Evidence for SMS OTP Login Polling Status When Provider Webhooks Are Missing
Short answer: for a B2B marketplace using SMS OTP login, choose a provider boundary that emits the verification evidence your reviewers need. When there are no webhooks, polling can enrich the delivery-status trail, but a delivered receipt must never decide that the seller proved possession. A hosted verification service is the smallest operational surface; owning the code lifecycle gives finer…
When a B2B marketplace uses SMS OTP login but lacks provider webhooks, polling becomes crucial for creating a comprehensive delivery-status trail. However, a delivered receipt should never be used to confirm seller possession of the code. Using a hosted verification service provides the smallest operational surface, while owning the code lifecycle allows for finer evidence and policy control.
To meet reviewers' needs, the chosen boundary must retain essential evidence, including challenge ID, outcome, timestamps, and policy version. Reconcile external outcomes with the login audit record for accurate authorization. With an application-owned challenge over SMS, reviewers can control expiry, attempts, or resend lineage, ensuring secure generation and race handling.
When reviewing the SMS OTP login process, separate the authentication system's decision on whether a presented code is valid for one challenge from the delivery system's answer on what happened to a message. The decisive split lies between these two functions. Choose hosted verification when its lifecycle aligns with your policy, and let the application manage challenge generation, expiry, and comparison.
Ensure code generation uses a cryptographically secure random source, and store a keyed digest instead of the actual code. Make verification atomic and ensure that one successful comparison consumes the challenge. Implement a phishing-resistant primary authenticator with separately governed SMS recovery for high-power accounts, as NIST SP 800-63B treats out-of-band authentication over the public switched telephone network as risky.
Polling proves only what the queried status contract defines. When there are no webhooks, polling should start after a short delay, back off, and stop at a documented terminal state or fixed deadline. Preserve the last response time and do not poll from the browser, as it can multiply traffic and stop when the tab closes. Maintain two separate rails: one for challenge state (pending, verified, denied, expired) and another for message status (accepted, in transit, delivered, undeliverable, unknown).
Share a correlation ID between the rails but avoid creating an arrow from delivered to verified, as no receipt can prove possession.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
