Designing authentication for borrowers who have never created a password

• Stateless HMAC-signed verification tokens with a 60-second time-to-live instead of storing OTP state in a database table.
• Dynamic OTP delivery routing: prioritizes email delivery over SMS to save messaging costs, falling back to SMS when email is absent.
• Anti-enumeration response normalization: valid and invalid lookups return identical response timing to defeat automated scraping of valid case IDs.

import hmac, hashlib, time

SECRET_KEY = b"firm-auth-signing-key"

def generate_otp_token(case_id: str, otp_code: str) -> str:
    timestamp = int(time.time())
    payload = f"{case_id}:{otp_code}:{timestamp}"
    signature = hmac.new(SECRET_KEY, payload.encode(), hashlib.sha256).hexdigest()
    return f"{payload}:{signature}"

def verify_otp_token(token: str, submitted_code: str, max_age_secs: int = 60) -> bool:
    try:
        case_id, expected_code, ts_str, sig = token.split(":")
        if time.time() - int(ts_str) > max_age_secs:
            return False
        if not hmac.compare_digest(expected_code, submitted_code):
            return False
        expected_sig = hmac.new(SECRET_KEY, f"{case_id}:{expected_code}:{ts_str}".encode(), hashlib.sha256).hexdigest()
        return hmac.compare_digest(sig, expected_sig)
    except Exception:
        return False