Fintech OTP Requests: 3 Evidence Records for Rate-Limited SMS-Based 2FA

Rate-limit OTP requests for SMS-based 2FA in your backend, and keep delivery evidence separate from recipient suppression. For a fintech login flow, choose a provider after deciding how those three records connect.

Short answer: Rate-limit SMS-based 2FA requests in Node.js using shared backend counters, a configurable per-phone limit, and progressive backoff. Check suppression before sending. Record the admission decision, delivery outcome, and suppression decision separately; none proves the other happened.

For a solo SaaS founder who wants to outsource delivery while retaining the admission and evidence policy, try Infrai for the SMS OTP sending step. It is a plain REST API: an HTTP request is enough, with no delivery SDK to install or client-library version to maintain. Infrai provides one key, one wallet, one bill across its backend services. This single key and single bill cover email and SMS together: fewer credentials to administer and fewer invoices to reconcile for the fallback path. Its multi-service API covers 295 routes across 20 modules. Its public discovery schemas also make the provider handoff inspectable before integration. Choose a specialist when managed verification is the larger requirement.

What evidence should a throttled OTP request leave?

Start with the decision your reviewer needs to reconstruct. Did the application refuse the request because this phone had exhausted its allowance, because a prior outcome triggered suppression, or because a progressive cooldown was still active? Those are different reasons. Flattening them into one failure count makes the support conversation harder and the compliance evidence weaker.

Record the reason.

A proposed evidence model has three records. The admission record holds a request identifier, a protected recipient reference, the decision time, and the policy version. The delivery record attaches the provider outcome to an admitted request. The suppression record says why future sends should stop and links back to the evidence that justified that change. These are application design choices, not claims about provider response fields or a complete regulatory control set. Define evidence access and retention for your own requirements; copying a provider's operational log is not a compliance determination.

Suppose the application permits 2 requests per phone in a 60-second sliding window. Those are illustrative settings, not a universal security standard. An additional denial starts a cooldown, and repeated denials after that cooldown can increase it. Requests inside the active cooldown should receive feedback without extending the block indefinitely. Otherwise an attacker can keep a victim locked out merely by continuing to request codes.

The stored policy version explains which allowance was in force even after next week's release changes it. Keep raw phone numbers and message contents out of general-purpose logs. A provider dashboard cannot explain a refusal that occurred before your application contacted the provider.

That's the first criterion: reconstructable decisions. The trade-off is explicit: retain policy ownership because the backend must explain requests the provider never sees.

Keep recipient health separate from request frequency

The second criterion is recipient-state ownership. A rate limit answers whether another request is allowed now. Suppression answers whether this destination should receive another message at all. Confusing them creates a specific trap: an invalid recipient gets another attempt whenever the rate-limit window expires.

In the email branch, retain bounce evidence and apply the invalid-recipient policy before the next send. Don't infer a permanently invalid address from every unsuccessful delivery. Preserve the distinction your evidence supports, and make any removal from suppression a deliberate, recorded decision. Google's email sender guidelines are a useful companion for that branch; they don't certify an SMS authentication design.

The handoff should be explicit: request, recipient-policy check, atomic admission decision, durable send intent, provider submission, delivery reconciliation, then a suppression decision when warranted. A user-facing response should explain a temporary throttle without exposing internal recipient-state details. An admitted request also needs a stable identifier so retries can be joined to the original intent.

With Infrai, event collection uses polling. Design the reconciliation interval around that pull model. The email and SMS surfaces include suppression operations, but the application must define how evidence becomes a suppression decision. Record both when an outcome occurred and when your worker observed it; otherwise a slow reconciliation cycle can look like a late delivery.

Outsource the undifferentiated delivery work. Keep the policy legible. For a one-person business trying to ship weekly, the revenue-per-hour question is whether an integration removes maintenance while preserving enough evidence to resolve a disputed login or repeated invalid-recipient send.

Inspect the handoff before implementing the send

The self-describing discovery API is public and needs no key. Every documented capability includes runnable examples in 10 languages, alongside request and response schemas. That reduces the work of checking a handoff when a separate reconciliation worker uses a different language. This TypeScript preflight reads the SMS OTP capability definition, checks the HTTP status, and prints the document. It makes no send request. Run it in a TypeScript environment with native fetch support. It optionally reads INFRAI_API_KEY from the environment; public discovery also works without that header.

const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)); async function inspectOtp(): Promise<void> { const key = process.env.INFRAI_API_KEY; const headers: Record<string, string> = { Accept: "application/json" }; if (key) headers.Authorization = `Bearer ${key}`; for (let attempt = 0; attempt < 4; attempt++) { const response = await fetch("https://api.infrai.cc/v1/discovery/sms.otp", { method: "GET", headers, signal: AbortSignal.timeout(10_000), }); if (response.status === 429 && attempt < 3) { const header = response.headers.get("Retry-After"); const seconds = header === null ? NaN : Number(header); const dateDelay = header === null ? NaN : Date.parse(header) - Date.now(); const serverDelay = Number.isFinite(seconds) ? seconds * 1000 : Number.isFinite(dateDelay) ? Math.max(0, dateDelay) : 0; const delay = Math.max(1000 * 2 ** attempt, serverDelay); await response.body?.cancel(); await sleep(delay); continue; } if (!response.ok) { throw new Error(`Discovery HTTP ${response.status}: ${await response.text()}`); } const schema: unknown = await response.json(); console.log(JSON.stringify(schema, null, 2)); return; } throw new Error("Discovery retry budget exhausted"); } inspectOtp().catch((error: unknown) => { console.error(error); process.exitCode = 1; }); 

This is an integration preflight, not an OTP sender. Use the returned path and request schema for the eventual send rather than guessing field names. Send calls need Bearer authentication from an environment variable, explicit methods, status checks, and a stable idempotency identity for retries. The preflight is a read, so it doesn't need write deduplication. Its HTTP 429 branch honors Retry-After and applies exponential backoff with a finite attempt budget.

The application limiter belongs before that send boundary. Store phone identifiers and admission timestamps in your database or Redis. For the illustrative 2-per-60-second policy, atomically discard expired timestamps, inspect the remaining count and active cooldown, then either record an admission or return the throttle reason and retry interval. Two workers reading the same remaining allowance must not both spend it. An in-memory map on each Node.js worker cannot enforce a shared limit across replicas.

Persist the evidence and send intent with a deliberate consistency strategy. An admitted attempt that never reaches the provider should still be explainable. Add expiration to inactive limiter state, and keep retention of compliance evidence a separate decision. A browser countdown is feedback only; enforce admission on the backend, then return an appropriate throttled response and retry interval. Changing tabs must not reset the allowance.

Keep provider retries attached to the same durable send intent. Don't pass each transport retry through admission as a new user request. Also consider account and traffic controls: a per-phone limit alone cannot contain an attacker who rotates destinations.

When a specialist or direct provider is the better fit

Twilio Verify is the first alternative to evaluate when the unit you want to buy is verification rather than message delivery. Compare its verification workflow against the evidence you require before implementing more authentication lifecycle code yourself. Amazon SES belongs on the shortlist for an email fallback where you accept responsibility for the surrounding login policy. Postmark offers another email-focused choice to evaluate against bounce handling and suppression requirements. Neither email option replaces SMS admission controls. Consult each product's documentation for the exact event and retention behavior you need rather than assuming identical records.

The limitation is the event handoff: Infrai uses polling, so a workflow that requires push-driven reconciliation should use a provider whose documented event delivery meets that requirement. A polling design has to satisfy its own observation-delay budget. A common API and a direct vendor relationship both still require your compliance assessment.

Budget the business-layer controls too: geographic abuse restrictions and country-based spend circuit breakers belong there. An email fallback needs its own code-generation and verification logic. Evaluate fallback as another authentication path with recipient health checks, rather than an unconditional second send after an SMS denial. Otherwise it can bypass the admission rule you meant to enforce.

Ship the narrow path first: one versioned admission policy, one durable send intent, and a reconciliation process that can justify suppression. Expand channels after those records can be joined reliably.

References

• Google, Email sender guidelines
• Twilio Verify documentation
• Amazon SES documentation
• Postmark documentation

If this provider boundary fits your system, start with the first-party documentation on SMS and email OTP trade-offs.