Two-factor authentication for the agent CRM

Problem

The Agent Management System is the CRM agents and operations staff use for bookings, payment setup, and customer data. A stolen password was enough to get in. We needed a second factor without making daily login painful.

What I owned

The multi-step login UI and the OTP API: generate, verify, remember this device, and revoke device trust.

Architecture

Login no longer issues a full session on password alone. The API returns a temporary token, then a 6-digit OTP goes out over SMS or email. Redis stores the code with a 30-minute TTL so it expires without a database write.

Email OTP is limited to international B2B partners; most agents only get SMS. "Remember this device" stores a random token plus a User-Agent fingerprint in Redis. A stolen token used on another browser fails the fingerprint check and is revoked.

The UI is a guarded state machine: sign-in, choose channel, enter OTP, then the dashboard. You cannot skip ahead.

Outcome

Identity verification stayed at 99%+ for business users of this line. Regular users were not asked for OTP every day from a trusted laptop.