Node.js SMS OTP Login Polling for Creator Payouts (with 2FA Evidence)
TL;DR: For a marketplace payout challenge, treat SMS as a restricted authentication channel and delivery status as evidence about transport, not proof that the seller received or entered the code. Keep provider credentials and OTP verification on the server. Let the browser poll your own short-lived challenge resource, while a signed delivery callback updates an append-only event history. Require…
When implementing SMS OTP login for creator payouts using Node.js, it is crucial to treat SMS as a restricted authentication channel and focus on delivery status as evidence about transport, not proof of the seller receiving or entering the code. The server should handle provider credentials and OTP verification, while the browser should poll your own short-lived challenge resource.
This pattern is useful when it fits, as it provides evidence, a clear separation of concerns, and avoids the need for live browser updates. The main limit is server polling only, as callbacks are unavailable in this scenario. The browser and server interact through three linked records: Challenge for authentication, MessageAttempt for transport, and AuditEvent for observed transitions.
Keyed digests of the OTP should be stored, not the OTPs themselves, to avoid message bodies in logs and mask phone numbers in operational views. The hybrid approach combines callbacks and first-party polling, with each mechanism handling a specific job. This pattern is not suitable for phishing-resistant authentication, users without stable phone access, or organizations unable to operate callback verification and event reconciliation.
Implement a server-owned state machine to manage delivery states and challenge states, ensuring a clear separation between authorization consequences for transport failures and payout verification.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
