OTP Authentication That Doesn't Leak Money

Challenge

BrokerApp's mobile application originally relied on password-based authentication. The objective was to migrate the existing production application from password-based authentication to OTP-based authentication, making it easier for both new and existing users to access their accounts.

Implementing OTP authentication itself was straightforward. Designing an authentication workflow that remained user-friendly, prevented misuse, and kept SMS costs under control required considerably more thought.

Replacing passwords with OTPs appears to be a simple user experience improvement i.e. a user enters a phone number, receives an OTP, and signs in. However, this introduces operational and security challenges that do not exist with password-based authentication:

• →

  Unnecessary OTP requests increase cost: Without validation, anyone could trigger SMS sends to arbitrary numbers whether registered or not.

• →

  The authentication endpoint needed abuse protection: Repeated requests could overload the backend and SMS provider, driving up costs, and negatively affecting service reliability.

• →

  Incomplete signups from wrong phone numbers: Users who mistyped their number during registration created orphaned, unverifiable accounts. The system needed a reliable way to distinguish verified accounts from incomplete registrations without adding complexity to the signup process.

Approach

Rather than treating OTP generation as the first step of authentication, we redesigned the workflow so that OTP generation became the outcome of server-side validation. This allowed the application to preserve a simple user experience while giving the backend complete control over when an OTP should actually be generated.

Login Workflow

The redesigned login process begins when the user submits their mobile number. Instead of waiting for backend validation to complete, the application immediately navigates to the OTP verification screen and displays the message:

"OTP sent if account exists."

This keeps the interaction responsive while avoiding any indication of whether a particular phone number is registered.

In the background, the backend performs a series of validation checks. The submitted mobile number is matched against an existing account and be active before an OTP request is generated. Only after these checks succeed does the backend request an OTP from the SMS gateway. If no matching account exists, no OTP is generated and no SMS is sent.

By separating user interaction from OTP generation, the application avoids unnecessary SMS requests while presenting a consistent experience regardless of whether an account exists.

Rate Limiting and Retry Controls

To reduce excessive SMS OTP generation, several safeguards were built into the authentication workflow:

• →SMS-based OTP requests limited to five per account within a 24-hour period
• →A resend cooldown of 30 seconds to prevent repeated requests in quick succession
• →Each OTP remains valid for two minutes before expiring automatically
• →Once the daily SMS limit is reached, users can request an OTP through their registered email address or wait until the limit resets after 24 hours

These controls reduced unnecessary OTP generation without creating friction for legitimate users.

Signup Verification

During signup, account verification became an explicit part of the registration process:

• →Accounts are created with a verification status maintained within the application's database
• →Only after successful OTP verification is the account marked as verified
• →If verification is never completed, the account remains unverified, allowing the application to distinguish incomplete registrations from active users

Authentication Event Tracking

The authentication workflow was instrumented to capture operational events throughout the login journey. The backend records events such as:

• →Login requests received
• →OTP requests generated
• →Responses received from the OTP service provider
• →OTP delivery status
• →Retry attempts
• →Successful authentications

Importantly, the application never stores OTP values.

This event tracking provides visibility into how the authentication system behaves in production and makes it significantly easier to diagnose delivery issues, understand user behavior, and monitor the performance of the external OTP provider.

Results

The redesigned authentication workflow successfully replaced password-based login with a simpler OTP-based experience while maintaining operational control over authentication.

Users no longer need to remember passwords, reducing friction during both onboarding and subsequent logins. Server-side validation ensures that SMS OTPs are only generated for active accounts, helping reduce unnecessary messaging costs and discouraging misuse of the authentication endpoint.

Built-in rate limiting, resend cooldowns, OTP expiry, and email-based fallback provide multiple layers of protection without compromising usability. The introduction of verification status during signup allows the application to distinguish verified users from incomplete registrations, improving the overall integrity of the onboarding process.

Capabilities Delivered

• →Passwordless authentication flow
• →Server-side account validation before any OTP is generated
• →Daily SMS limits with email fallback path
• →Account verification flag separating complete from incomplete signups
• →Full authentication event tracking without storing OTP values

Our Perspective

The real challenge was designing an authentication workflow that balanced user experience, operational cost, and system reliability.

By validating accounts before generating OTPs, introducing sensible request controls, and instrumenting the entire authentication lifecycle, BrokerApp achieved a faster and simpler login experience while retaining full visibility into how authentication performs in production. Authentication became an observable system rather than a black box. The engineering team can now answer operational questions like how many users request an OTP but never complete login, how often users request multiple OTPs, and whether OTP delivery issues are affecting successful authentication.