Engineering / ENG-1419
Sign in with a phone number and a code sent by SMS
Description
As a depot worker without a company email, I sign in with my mobile number and a code by SMS, so I don't need a password.
Acceptance criteria
- The sign-in page offers "Sign in with a phone code" for people whose sign-in is Phone code.
- The code has 6 digits and works for 10 minutes. Asking for a new code cancels the old one.
- A new code can be asked for after 60 seconds.
- Five wrong codes, and the person waits 15 minutes.
- Codes are never logged. Logs show the last 3 digits of the number only.
- After signing in, the session is the same as anyone's.
Comments (2)
Lena Fischer · 12 May 2026, 07:05 UTC
Wording on the screen: "We've sent a code to the number ending 482. It works for 10 minutes." No "OTP" anywhere.
Codes stored hashed with the person id and expiry, one row per person; a new request overwrites. Checked in constant time.