Sms verification looks simple at the beginning, but actually it has lots of non-functional requirements.

Here is some of them:

1. Set rate limit to sms verification code sending, e.g Sends no more than once to a given phone number in 60 seconds.
2. Set a retry cap, e.g. Invalidate the code given 5 failure verification attempts.
3. Any phone number should be masked before logging
4. Set a short expiry to the verification code, e.g 2 minutes
5. Invalidate the original verification code when a new code is generated for a given phone number.

You get a vulnerable implementation if you don't tackle these requirements, so it takes more time than you expect.

Project daming aims to provide battle tested components so that you can embed them into your project with minor configuration effort.