01
Request a code
Generate a one-time challenge from your application backend.
02
Validate securely
Verify the submitted code server-side and apply sensible expiration and retry limits.
03
Protect your users
Add rate limits, abuse monitoring, and fallback paths to your authentication flow.