Phone verification looks like a two-hour feature. You send a code, the user types it back, you compare strings. Then it hits production and you discover that "receive an SMS" is not an operation your backend controls — it is an operation you wait on, with no guaranteed upper bound, across networks you have no visibility into.
This post is about the part nobody writes docs for: how you actually get the code into your application, and the specific ways each approach fails.
The three shapes of the problem
Most teams end up in one of these situations:
You send the OTP yourself and need to test the receiving end during development and CI.
