Security
Identity work is deterministic. Always.
Verification, authorization, role checks and code validation are executed by the platform in code. No language model is ever in that path — models are limited to content generation and assistive suggestions.
Codes
- Cryptographically secure random generation
- Stored hashed, never in plaintext
- Single use, invalidated on success or expiry
- Constant-time comparison on verification
Limits
- Configurable expiry, 10 minutes by default
- Maximum attempts per code
- Rate limits per contact, account, bot and IP
- Replay protection with idempotency keys
Transport and secrets
- HTTPS-only endpoints
- HMAC signatures or bearer tokens
- Write-only secret values, never redisplayed
- Full delivery and retry logs
User control
- Self-service unlink from the messaging channel
- Admin revoke with audit entry
- Consent state stored per contact
- GDPR export and deletion
On calling it two-factor authentication
A bot approval step can serve as one authentication factor. NextChatbots calls this feature Login Approval and describes it as an additional verification step. It is only genuine two-factor authentication when it is combined with a different factor in a correctly designed authentication system — and it never replaces one.