Everything worth knowing, nothing that isn't.
The stages
Request (the app asks to verify a number), deliver (a code or network check goes out), respond (the user enters the code or the network confirms possession), and resolve (the flow confirms or fails). Each stage should be logged for security without storing the secret. See /answers/how-to-build-otp-flow.
Make it multi-channel
Cascade methods so reach and cost are balanced: silent network authentication where supported, SMS OTP for universal reach, voice as a fallback. See /answers/best-channel-for-otp and /answers/what-is-silent-network-auth.
Make it risk-aware
Step up verification for risky actions or unusual destinations, and rate-limit to resist abuse — a good flow adapts its friction to the risk. See /answers/what-is-rate-limiting-sms.
Measure it
Track delivery, conversion, and time-to-verify per channel and country, so you can tune the cascade for the markets you actually serve. See /answers/how-to-improve-sms-delivery-rates.