{
  "id": 3326311,
  "title": "Should a SaaS Password Recovery Flow Use Email API or SMS OTP?",
  "url": "https://urgent.news/2026/08/25/should-a-saas-password-recovery-flow-use-email-api-or-sms-otp",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-25T18:16:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/holdenfox8476/should-a-saas-password-recovery-flow-use-email-api-or-sms-otp-4h42"
  },
  "original_language": "en",
  "account": "When considering a SaaS password recovery flow, use an emailed reset link as the default method for most users. Reserve SMS One-Time Passwords (OTP) for situations where users may not have email access, or if the product already maintains verified phone numbers. Email offers simplicity as it consolidates the login identifier, recovery destination, and support workflow within a single channel. However, SMS can reduce the interaction time but introduces additional complexities such as phone number lifecycle management, message segmentation, regional consent, and delivery status tracking.\n\nIt's important to note that the decision should focus on recovering the correct user account without turning potential delays, expired credentials, or recycled phone numbers into security breaches or increased support workload. The recovery process is about returning the rightful user to their account, not merely sending notifications.\n\nFor email-based recovery, generate a high-entropy, single-use token, store it securely, and send a link to the user. The user then signs into a password-change session using the token before it expires. In contrast, an SMS OTP flow appears visually compact, but it requires additional backend considerations. These include verifying the phone number, allowing updates without requiring sign-in, normalizing country codes, handling reassigned numbers, supporting users who lose their device, and ensuring safe recovery paths for affected users.\n\nWhile email might not be ideal when users frequently lose access to their mailbox, it serves well when email addresses are stable identifiers and recovery is infrequent. SMS is not suitable when users often lack reliable phone numbers, if the product cannot staff regional messaging operations, or if collecting phone numbers would result in significant privacy and compliance challenges. Neither method can be a universal solution.\n\nBefore deciding on delivery methods, consider that email delivery begins with domain alignment, message integrity checks (like DKIM), and proper handling of bounces, suppressions, and monitoring. The email recovery form should be straightforward, avoiding unnecessary tracking, not revealing the current password, and clearly displaying the expiration date without exposing account status. The same principle applies to SMS: keep the OTP message brief, preferably under 160 characters for GSM-7 or 70 for UCS-2, and avoid complex characters that could lead to multiple message segments. Test your OTP templates thoroughly across different locales and character encodings to ensure accurate delivery.\n\nBoth email and SMS are asynchronous processes. The user interface should clearly indicate that \"sent\" does not mean \"received,\" and the system should prevent multiple valid credentials from being created simultaneously. To manage recovery effectively, treat email links and SMS codes as separate presentations of the same recovery challenge. A challenge consists of key attributes like subject, channel, destination, creation time, expiry, attempts, sends, and terminal state. Focus on logging challenge identifiers and transition reasons rather than raw tokens or OTPs.\n\nKey transitions include requesting recovery, returning neutral responses during delivery, accepting the code or token upon successful delivery, and rejecting invalid attempts. The system should have clear expiration rules and supersede old recovery attempts with newer ones. Implementing these guidelines ensures a robust and secure password recovery flow that protects both user accounts and the SaaS platform's integrity.",
  "summary": "Short answer: use an emailed, single-use reset link as the default for most SaaS login recovery, and add SMS OTP only where users may genuinely lack email access or the product already maintains verified phone numbers. Email is usually the simpler system because the login identifier, recovery destination, and support workflow can remain in one channel. SMS can shorten the interaction, but it adds…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}