In a Node.js gaming login, sending OTPs via SMS and email means more than calling two providers. The player needs one valid 2FA code, at least one reachable channel, and a record that explains what the system attempted to deliver. A provider outage, a duplicate retry, or an untracked fallback can turn a five-second login into a support ticket.

Short answer: generate one OTP, store a hash or protected value in Redis with a short expiration, then send the same challenge through SMS and email concurrently. Let the player complete the login with either channel. Record each provider request and later reconcile delivery events by polling, because neither channel provides webhook event pushes in this setup.

The useful mental model is a small state machine. Before the change, “send code” is one opaque action.…