Forgot Password OTP Expiration Issue in Auth0 Universal Login When Using Mobile Number for OTP Delivery

Get Help
, ,
1

Hi everyone,

I’m currently using Auth0 with the following setup:

  • New Universal Login

  • Username/password authentication

  • Custom Database Connection

  • Mobile number or username as the identifier

  • Authentication profile uses Identifier + Password (Default)

  • Custom SMS provider for OTP delivery

We are using Auth0’s forgot password flow with mobile number support.

The current flow works like this:

  1. User enters their mobile number

  2. OTP is sent via SMS

  3. User verifies the OTP

  4. User resets the password

The issue we are facing is related to OTP expiration.

Currently, the OTP only becomes invalid when a new OTP is requested. Otherwise, the same OTP remains valid indefinitely.

Our requirement is:

  • OTP should automatically expire within 3 minutes even if the user does not request a new OTP.

Since we are using Universal Login, custom database connections, and a custom SMS provider, I would like to know:

  1. Does Auth0 provide any built-in way to enforce OTP expiration for this flow?

  2. Can OTP expiry be configured through Auth0 (we are not using the Passwordless flow)?

Would appreciate any guidance or best practices from anyone who has implemented a similar setup.

Thanks!

3

Hi @yamunanga

Welcome to the Auth0 Community!

Auth0 does not currently provide a built-in way to customize or enforce a strict 3-minute OTP expiration specifically for the Database Connection password reset flow.
OTP expiry configuration is currently strictly limited to the Passwordless flow. For standard Database Connections utilizing phone number identifiers, Auth0 controls the underlying OTP lifecycle, and the expiration time is not exposed as a configurable setting.

I would highly recommend submitting a feature request on the community or upvote one which was previously created on the same matter.

Otherwise, your options would be to either shift to a Passwordless flow for your application (which is not ideal I believe) or to externalize the password reset flow through a custom portal handled by your backend.

If you have any other questions, let me know!

Kind Regards,
Nik