From Dev.to
Build a Secure OTP Service: Custom Node.js Generation, Validation, and External SMS
Short answer: make the Node.js service own code generation, expiry, attempt limits, and one-time consumption; make the external SMS API own delivery. Store only a digest of each code, bind it to a log...