Passwordless Phone Login in Express Node.js: SMS OTP Flow (and Why Evidence Wins)

In Express Node.js passwordless phone login systems, a secure SMS OTP flow should incorporate several key components. First, implement an outbox row within the same database transaction as the settled payment. This row, combined with an asynchronous sender, provides a clear audit trail without pretending that message acceptance equals message reading.

The outbox approach offers several advantages over inline sends from the payment request. It maintains local intent, tracks attempts and responses, and allows for timestamps, all without the need for a separate worker and retention policy. This keeps the system simple yet robust, making it easier for compliance teams to verify evidence.

The outbox should be the default choice, as it balances evidence quality and failure handling over lowest message pricing. When implementing SMS OTP in Express Node.js, create a challenge with a short expiry, store only a verifier, and bind it to a normalized phone identity. Return the same public response for unknown and known phones to prevent enumeration.

Enforce a cooldown, maximum resend count, and maximum verification attempt count per challenge, and maintain an anti-abuse limit per phone fingerprint, IP range, and device signal.

When a receipt needs to be sent, distinguish between business truth (order settlement) and transport truth (message delivery). The payment service confirms that the order settled, while the messaging worker confirms message attempts, provider callbacks, and their results. Store a stable event ID, order ID, optimization details, destination fingerprint, channel, attempt number, provider message ID (when available), response status, and callback timestamps. Do not store phone numbers in every log line to limit accidental exposure.

A "200" response from a submission endpoint proves request acceptance, but it does not prove handset delivery or that a human read the receipt. To handle failures gracefully, use an idempotency key like "receipt:ord_4821:v3". A worker takes ownership of the receipt job, applies leases with bounded retries, and records outcomes in the outbox. This approach avoids duplication and ensures that only one durable boundary exists, even if the process dies before marking the send as complete.

In summary, a passwordless phone login in Express Node.js should use an outbox-based SMS OTP flow with robust audit trails, throttling, and anti-abuse measures. Separate business and transport truths, and employ a clear, idempotent keying system to maintain a trustworthy audit record.