The scenario
A React Native app lets users reset passwords via OTP sent by Twilio. The API verifies the phone number, generates and validates OTPs, and updates credentials in Firebase Auth.
What is in this drawing
Read the decisions behind it.
01
Whether the requested phone number matches an existing user account.
02
Whether the OTP is valid and not expired before allowing password change.
03
Whether to allow retries after failed OTP verification, up to a maximum attempt limit.
Use this flow when designing or documenting password reset with OTP using a separate SMS provider and identity service, especially for mobile apps.
More like this