A Node.js backend for SMS OTP login should send a code only after an atomic rate-limit decision, then verify it as a single-use challenge. For an edtech platform that reveals an order receipt after payment settles, the service should keep enough telemetry to answer three questions: was a challenge requested, was one dispatch attempted, and did verification reach a terminal result? Those answers require a small state machine, atomic counters, and deliberately low-cardinality events. They do not require storing every provider callback or every digit a learner submits.

TL;DR: issue a random single-use code, store only its keyed digest, enforce cooldown and rate limits atomically, and retry dispatch only when the outcome is known to be safe. Tie the authenticated session to authorization for the settled order; possession of a phone number must never become permission to read an arbitrary receipt.…