Strict Mode vs Frictionless Mode: Choosing the Right Auth for Your Product
Understand the differences between Strict Mode and Frictionless Mode in LessOTP: mechanics, security vs UX trade-offs, and how to pick the right auth mode.
Two Inbound Authentication Paradigms
With LessOTP's inbound authentication infrastructure (WhatsApp and Telegram), client applications don't need to send traditional SMS OTPs. Instead of blasting codes outwards, users verify themselves by sending a unique verification code inbound to the platform's official messaging number.
However, there is an essential architectural choice product and engineering teams must make when invoking the API: should you use Strict Mode or Frictionless Mode? This decision dictates whether your app asks for the phone number upfront or lets the platform resolve it dynamically.
Comparison Matrix: Strict Mode vs Frictionless Mode
| Aspect | Strict Mode | Frictionless Mode |
|---|---|---|
| Upfront Phone Input | Required (sent in API request payload) | None (request payload omits phone number) |
| Matching Logic | Inbound sender must strictly match the provided number | Inbound sender's number is extracted dynamically |
| End-User UX | 2 steps: fill phone form → send verification message | 1 step: single tap to open WA/Telegram and send |
| User Typo Risk | Present (wrong input causes a verification mismatch) | Zero (phone number originates directly from provider identity) |
| Primary Use Cases | Existing account login, password reset, high-risk actions | New user onboarding, frictionless signup, lead capture |
| Webhook Payload | Contains phone_number with verified match status | Contains dynamically resolved, verified phone_number |
When Should You Choose Strict Mode?
Strict Mode is designed for scenarios where the phone number is already known and bound to a specific user account. In this mode, the API request includes the `phone_number` parameter.
- Registered Account Login: Ensures the person attempting to log in is genuinely the owner of the phone number recorded in your database.
- Password Reset & Credential Changes: Prevents account takeovers by requiring the verification message to originate strictly from the bound number.
- Financial Transactions & High-Risk Authorization: Functions as a step-up 2FA layer when users perform withdrawals or adjust security settings.
- Identity Binding / KYC: Guarantees that the WhatsApp or Telegram channel linked to a user profile matches their registered records.
Strict Mode Request Example:
curl -X POST https://lessotp.com/api/v1/auth/request \
-H "Authorization: Bearer <YOUR_API_KEY>" \
-H "Content-Type: application/json" \
-d '{
"channel": "whatsapp",
"phone_number": "6281234567890"
}'When Should You Choose Frictionless Mode?
Frictionless Mode is tailored to eliminate onboarding friction for new users. Users do not need to type their phone numbers into a web form or mobile app at all.
- New User Onboarding: Users simply click 'Sign up with WhatsApp', send the prefilled message, and their account is immediately created.
- Campaign Conversions & Lead Generation: Eliminates drop-offs caused by tedious form typing or delayed SMS delivery.
- Zero Form Typos: Because the phone number comes straight from the WhatsApp message or Telegram contact sharing, form input typo risk disappears.
- Frictionless App Trial & Web-to-App Funnels: Seamlessly transitions mobile web visitors directly into your messaging ecosystem without repetitive inputs.
Frictionless Mode Request Example:
curl -X POST https://lessotp.com/api/v1/auth/request \
-H "Authorization: Bearer <YOUR_API_KEY>" \
-H "Content-Type: application/json" \
-d '{
"channel": "whatsapp"
}'Hybrid Strategy: Combine Both Across the User Journey
Many high-growth product teams do not pick one mode exclusively. Instead, they implement a layered step-up verification strategy:
1. Registration Stage (Frictionless): Deploy Frictionless Mode to achieve maximum conversion and frictionless signups.
2. Daily Session Checks (Frictionless or Strict): For routine re-authentications, offer single-tap frictionless verification.
3. Sensitive Actions (Strict): When users perform critical actions (e.g. changing payout details or passwords), enforce Strict Mode verification.
Test Both Modes in the Staging Environment
Experiment with Strict Mode and Frictionless Mode using the LessOTP Staging Simulator. Simulate inbound messages and receive signed webhooks instantly at zero cost.
Try Frictionless & Strict Auth