Short answer: For US/EU creator payout verification, use server-side Next.js or Node.js login endpoints, poll SMS OTP delivery from the backend, and keep the provider behind a small adapter.

For a SaaS app verifying creator payouts, that boundary lets the UI distinguish sent, delivered, failed, and retry-needed states without giving the browser the OTP secret. It also makes a provider change a contained migration instead of an auth rewrite.

The constraint that changes the design is template ownership. If the provider owns templates, switching vendors can become a message-format migration. If the application owns the message contract and the provider only transports it, changing vendors is mostly an adapter job. I prefer the second boundary for payout verification.…