OTP Session Management Best Practices (2026)

Session management around OTP has three phases: pre-verify partial session, the verify-itself transaction, and the post-verify long-lived session. Each has its own rules.

Three Session Phases

• Pre-verify: holds requestId only, 15-min TTL.
• Verify: short transaction, no new session.
• Post-verify: long-lived session with role + expiry.

Partial Session (Pre-Verify)

• HTTP-only cookie or short-lived JWT.
• Holds the OTP requestId, not user identity yet.
• 15-minute TTL aligned with OTP expiry.

Verified Session

• Issue after successful verify.
• Bind to user ID, device fingerprint, role.
• Set idle and absolute timeouts.

Cookies vs JWT

• Server-side sessions: revocable, simpler, slightly more state.
• JWT: stateless, harder to revoke, beware of long expiry.
• Most consumer apps use signed-cookie sessions; SaaS APIs use short-lived JWT + refresh.

Idle vs Absolute Timeouts

• Idle: time since last interaction.
• Absolute: time since session creation.
• Both checked on every request.

FAQ

Tie session expiry to action sensitivity: read-only sessions can live longer than write-capable ones.