Webhook-Free OTP Login: Polling Status and SMS Verification Implications

Webhook-free OTP login requires the application to maintain ownership of template copy, expiry rules, and verification logic. Polling improves operational visibility but should only provide transport evidence, not authentication truth. For marketplace payouts, SMS is a restricted channel where delivery status is evidence, not proof of receipt. Developers should keep OTP verification on the server, allowing browsers to poll short-lived resources while signed callbacks update event histories to mitigate phone-number takeover risks.