OTP engineering, end to end.
Ship one-time passwords that arrive, convert and hold up under attack.
Six deep series on delivery, verification UX, webhook signing, anti-abuse, fallback channels and SIM-swap fraud — with code you can run in the page.
OTP Delivery Fundamentals
What a one-time password actually guarantees, how a code travels from your server to a handset, and how to read the signals carriers send back.
- 1.What an OTP really is
- 2.Send your first OTP
- 3.Delivery reports and status codes
- 4.Encoding, length and concatenation
- 5.Sender IDs and trust
New chapters this week
All series →Fraud: SIM Swap & Beyond
Post-incident review
A blameless review template for OTP fraud and delivery incidents, and turning findings into controls.
Rate Limiting & Anti-Abuse
Monitoring abuse in production
The four dashboards and three alerts that catch OTP abuse within minutes instead of on the invoice.
Webhooks & HMAC Signing
Rotating secrets
A zero-downtime rotation procedure, with overlapping secrets and a clear rollback.
Verification UX
Error states and retries that don't leak
Wording errors so honest users recover quickly and attackers learn nothing they can use.
Fallback Channels & Resilience
Voice OTP and accessibility
Spoken codes for landlines, low vision and low literacy — and how to make them actually understandable.
OTP Delivery Fundamentals
Sender IDs and trust
Alphanumeric IDs, long codes, short codes and toll-free numbers — what each signals to users and carriers.
Guided series
Ordered chapters with explicit prerequisites, so each idea builds on one you already have.
Runnable demos
Playgrounds run real JavaScript against a simulated messaging SDK — sends, receipts, lockouts and real HMACs.
Persistent progress
Your progress, comments and theme stay on your device. No account, no tracking.