OTP+ B2B SMS & Social Login

Added a prominent resend button with a 30-second cooldown timer after support showed me the resend configuration. Before that, customers who missed the initial SMS had no idea how to get another code. Simple addition that reduced support tickets about 'I never got my code' by about half.

Wanted to pre-register phone numbers for existing customers to avoid a verification wall on their first post-install visit. Support ran a bulk import of 3,400 phone numbers from our customer CSV. Existing customers experienced zero disruption after the install.

Our support team couldn't access customer accounts because of OTP blocking them. Support configured a support agent bypass using specific IP ranges from our office network. Agents can log into customer accounts for troubleshooting while the OTP protection stays active for everyone else.

Two overlapping popups — OTP and age verification — were confusing customers. Support set the OTP widget to detect other popups and queue behind them. Age verification appears first, OTP triggers after age is confirmed. No more popup collision.

Wanted to share one OTP+ account across US and Canada Shopify stores. Support explained each store needs its own installation but showed me how to replicate configuration between stores using the settings export. Set up the second store in under five minutes with identical settings.

A customer reported receiving an unsolicited OTP code. Support checked the attempt log and found a failed login attempt from an unfamiliar IP. They helped me notify the customer and recommend a password change. Having the ability to trace exactly what happened turns a scary situation into a manageable one.

Our accessibility audit flagged missing aria labels on the OTP input. Support confirmed the issue and pushed a widget update within the week that added proper aria labels, keyboard navigation, and screen reader announcements. Our next audit passed clean. Responsive to accessibility concerns without pushback.

Made the returns portal OTP optional instead of mandatory after customers complained. Support configured a 'verify if suspicious' mode that only triggers when the return request has fraud signals — different address, high value, or multiple returns in a short period. Legitimate returns go through instantly, suspicious ones get checked.

Evaluated switching from SMS to email-based verification. Support walked me through the email OTP setup and helped me A/B test both methods. Email had a slightly lower completion rate but zero delivery cost. We ended up keeping SMS for new customers and offering email as a fallback. Support helped us run the test properly rather than just giving an opinion.

Monthly subscription renewals were triggering OTP verification even though the customer wasn't actively on the site. Support configured an exemption for automatic recurring charges. Subscriptions renew silently now, verification only fires on manual actions. Solved a problem I didn't realize I had until subscribers started emailing us about unexpected verification texts.

The checkout progress bar didn't show the verification step, confusing customers. Support gave me a theme code snippet that adds a 'Verify' step to the progress indicator. Customers now see where they are in the checkout flow and don't feel surprised by the verification. Reduced the confused support tickets we were getting.

Noticed a flood of failed verification attempts from one area code. Support investigated and confirmed it was a brute-force attempt. They enabled the rate limiter for that region — after three failed attempts, the IP gets temporarily blocked. The attack stopped within hours. Having someone who understands security patterns respond to that kind of question is reassuring.

B2B retailers logging in weekly found the 30-day trusted device period too short for their patterns. Support extended it to 90 days for accounts tagged as 'wholesale'. My retailers stopped complaining about the verification and some even mentioned they appreciate the security now that it's not intrusive.

Customers were entering phone numbers inconsistently — some with country codes, some without. Support enabled the automatic country code detection based on the customer's IP location. Now the input field pre-fills the country code and formats the number correctly. Small UX improvement that eliminated a common source of failed verifications.

The OTP widget was breaking inside our mobile app's webview. Support identified the webview rendering issue and provided a JavaScript bridge that handles the widget properly in webview contexts. Our app developer integrated it in half a day. They clearly had experience with this specific integration challenge.

Wanted OTP only on the login path, not guest checkout. Support configured the trigger to ignore guest sessions entirely. Guest checkout stays fast, account login gets verified. The distinction makes sense for our customer base where returning logged-in customers are higher value and worth the extra security step.

Asked about verification funnel analytics and support showed me a report I didn't know existed — completion rate, average time to verify, drop-off at each step, segmented by device type. The data showed mobile users complete faster than desktop users. Changed how I think about our checkout optimization priorities.

Our store serves Arabic-speaking customers and the OTP input needed to support RTL text entry. Support confirmed RTL is fully supported and showed me the language-direction setting I'd missed. Arabic customers now see the entire widget in right-to-left layout, including the phone input. Inclusive design that actually works.

Wanted to skip verification for our Gold tier loyalty members. Support configured a customer tag exemption — anyone tagged 'gold-tier' bypasses OTP automatically. My best customers get a frictionless experience while new customers still get verified. Exactly the segmentation I was hoping for.

We wanted phone verification on returns, not just login — to make sure the person requesting the return actually placed the order. Support confirmed the API supports custom trigger points and helped us hook the verification into our return form. Now the phone number on the return request has to match the order. Fraudulent return requests dropped noticeably.