Seven Mobile OTP Login Invariants for Backend APIs and Abuse Prevention

Short answer: model each SMS OTP as an auditable challenge that can be consumed once, and make the server—not the mobile screen—the authority for expiry, autofill acceptance, repeat-request limits, and recipient suppression. Those decisions belong in the security contract before a messaging adapter is selected. The concrete problem is deceptively small: a mobile user asks for a code, the app receives a text, and the user signs in. In production, the same endpoint is also a spending endpoint, a privacy boundary, and a fraud signal. A duplicate tap, a delayed carrier message, or a recycled phone number can turn a pleasant login flow into an account-enumeration or SMS-bombing incident. I approach this like a ledger. Every state transition needs an idempotency key, an audit record, and a clear owner. Seven invariants keep the design reviewable. Stop. Consent, retention, and privacy records The server creates a challenge with a random, short-lived code, stores only a salted hash, and binds the challenge to a normalized recipient plus a login intent. The client receives an opaque challenge identifier; it never decides whether a code is valid. Verification consumes the challenge atomically, so two concurrent requests cannot both win. A resend is a new delivery attempt on the same login intent, subject to a cooldown and a rolling budget. It must not silently invalidate a code that is already in transit unless the product explicitly documents that behavior. Suppression is checked before dispatch and again when delivery feedback is ingested. That second check matters for bounces, reassigned numbers, and manually blocked recipients. Option Strength Cost or boundary One service owns challenge and delivery state Simple audit trail and exactly-once verification Requires a durable store and transactional writes Separate identity and messaging services Teams can deploy independently Correlation IDs and replay rules cross a network boundary Client-generated code or expiry Fast proto