Node.js SMS OTP 2FA for property reports: securing the identity handoff

·3 views

The article explains how to add SMS one-time-password two-factor authentication to a Node.js property-report login as a multi-step state machine rather than a single SMS call. It recommends tying the identity lookup and the SMS send to the same authenticated API boundary so the code reaches the correct account. Each OTP attempt should store a server timestamp, an expiration decision, and a bounded retry count, and be accepted only once within a short server-side window. The author notes that a successful SMS delivery does not establish authorization, which remains the application's responsibility for each property and report. The piece also weighs a combined identity-and-SMS service against separate providers such as Auth0 or Clerk with Twilio Verify, citing the trade-off between fewer vendors and independent controls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Tool That Generates Custom Birthday Songs From Any Name

A developer frustrated by slow, paid personalized birthday song services built a free web tool that creates an original song featuring a chosen name. Users enter a name, select a musical style such as pop or acoustic, and receive a fully synthesized track with generated melody, vocals, and lyrics within seconds. The system combines a lyrics generator, a text-to-singing model, and a style-matched instrumental generator, with particular effort going into fitting longer names naturally to the melody. Listening and sharing are free and require no account, while downloads are a paid option to cover bandwidth and generation costs. The creator is now seeking feedback on how unusual names are pronounced, as improving that is the next priority.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guidance on Delegating Website Tasks to AI Assistants

An AI assistant is useful for a website as a helper for drafting, reviewing, and organising content rather than as an autonomous administrator. Whether it can make actual changes depends on the connected system and the permissions granted to it. Teams are advised to identify which specific tasks to delegate and to keep a person checking the results. Tools such as MCP let applications expose capabilities to an assistant, but the available tools vary with server and account configuration. Before relying on an assistant, users should confirm its read-only versus save-capable access and verify any facts, claims, or product details it produces.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Moving a Production API to Hetzner: Choosing and Creating the Server

A developer recently migrated a small production API from one VPS provider to Hetzner Cloud and wrote this first part of a three-part series as both a record and a tutorial. The guide explains Hetzner's server families, comparing shared Cost-Optimized and Regular Performance plans against dedicated General Purpose ones, along with their pricing and intended uses. It also covers the separate billing for public IPv4 addresses and the need to check container image architecture before choosing Arm servers. Measured resource usage on the old server, about 1 GB, guided the choice of a 2 vCPU, 4 GB Cost-Optimized plan as the cheapest option with ample headroom. Prices are noted as subject to change, and the author advises checking current figures in the console.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Undead Agent: A Local AI Agent That Resumes After Being Killed

A developer built Undead Agent, a local AI tool that summarizes text files with an open-weight Gemma model running through Ollama. The agent runs as Temporal durable workflows, so when its worker process is forcibly killed, a new process picks up from the exact step where it stopped without redoing finished work. Each resurrection is narrated by a ghost-like persona, and a dashboard records every life, death, and resurrection. The project was submitted to the Hacktoberfest Open-Source AI Challenge and is available on GitHub, with a hosted demo page replaying a recorded run. The developer's aim was to show that long multi-step AI jobs can survive crashes without starting over and paying for repeated model calls.

0 comments Read more at DEV Community