Authorize a property-management receipt only when the backend can connect one successful SMS challenge to one server-created session. Treat resend as a state transition, not another send button. The practical rule is short: Express owns expiry, cooldown, attempt budgets, and lockout; the SMS service owns delivery and code verification.

Short answer: model send , resend , verify , expire , and lock as explicit transitions. Apply increasing cooldowns and daily caps across phone, IP, and device, check suppression before delivery, and retain only enough evidence to reconstruct the authorization decision. This design supports passwordless access without accepting a browser timer as a security control.

What must a receipt-access record prove?

Begin at the payment boundary. A settled payment creates the receipt, but it does not prove that the person requesting access controls the phone number associated with the property account.…