Twilio One-Time Passcode Verification Service

Overview

This is the as-built FlowLibs reference for the Twilio One-Time Passcode (OTP) Verification Service - a reusable, two-flow SMS verification service. A Request endpoint generates a 6-digit passcode, stores a salted digest with expiry/attempt limits in Dataverse, and texts the code via Twilio. A Verify endpoint checks a submitted code against the stored digest and enforces expiry, single-use, and attempt limits. Other apps and flows call these HTTP endpoints to add SMS verification (login, high-risk actions, callbacks) without reimplementing OTP logic.

Both flows ship Off. Going live requires only authorizing the connections and setting environment-variable values.

Use Case

Apps repeatedly need a quick SMS verification step and OTP is easy to get subtly wrong (expiry, replay, brute force). This service standardizes it behind two endpoints, keeps the passcode out of every calling app, persists an auditable Dataverse record per request, and carries a correlationId so issuance and verification can be traced end-to-end.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Twilio	shared_twilio	SendMessage
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord GetItem UpdateRecord

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Production-grade hashing

Replace the salted base64 digest with an HMAC-SHA256 computed via an inline HTTP call to an Azure Function; the salt+digest+recompute+compare pattern stays identical.

Twilio Verify

Swap the custom store for Twilio's managed Verify API for built-in delivery and fraud controls.

Endpoint security

Add a shared-secret header check (or APIM/Entra) on both Request triggers before go-live; the demo endpoints are open.

Rate limiting

Add a per-number send throttle (e.g. a Dataverse ListRecords count over a window) in the Request flow.

Voice fallback / WhatsApp

Reuse the same Twilio SendMessage op with a whatsapp: prefix, or add a voice-call fallback if SMS fails.

Lockout window

Add a timed unlock instead of a permanent Locked status.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@string(rand(100000,1000000))

@base64(concat(variables('varSalt'),variables('varCode')))

@addMinutes(utcNow(),variables('varExpiryMinutes'))

@less(ticks(utcNow()), ticks(body('Get_OTP_Record')?['flowlibs_expiry']))

@less(body('Get_OTP_Record')?['flowlibs_attempts'], body('Get_OTP_Record')?['flowlibs_maxattempts'])

@equals(variables('varRecomputedHash'), body('Get_OTP_Record')?['flowlibs_codehash'])

@sub(body('Get_OTP_Record')?['flowlibs_maxattempts'], add(body('Get_OTP_Record')?['flowlibs_attempts'],1))

@replace(replace(parameters('EnvVar_OtpMessageTemplate'),'{code}',variables('varCode')),'{minutes}',string(variables('varExpiryMinutes')))

Customize & download