OTPs that find a way in

Send and verify one-time passwords with two API calls. WhatsApp first, then SMS, voice or email if the code is not delivered in time, with hashed codes, attempt limits and every try in the log.