Security

Identity work is deterministic. Always.

Verification, authorization, role checks and code validation are executed by the platform in code. No language model is ever in that path — models are limited to content generation and assistive suggestions.

Codes

  • Cryptographically secure random generation
  • Stored hashed, never in plaintext
  • Single use, invalidated on success or expiry
  • Constant-time comparison on verification

Limits

  • Configurable expiry, 10 minutes by default
  • Maximum attempts per code
  • Rate limits per contact, account, bot and IP
  • Replay protection with idempotency keys

Transport and secrets

  • HTTPS-only endpoints
  • HMAC signatures or bearer tokens
  • Write-only secret values, never redisplayed
  • Full delivery and retry logs

User control

  • Self-service unlink from the messaging channel
  • Admin revoke with audit entry
  • Consent state stored per contact
  • GDPR export and deletion

On calling it two-factor authentication

A bot approval step can serve as one authentication factor. NextChatbots calls this feature Login Approval and describes it as an additional verification step. It is only genuine two-factor authentication when it is combined with a different factor in a correctly designed authentication system — and it never replaces one.