Login with OTP sequence diagram
This sequence diagram shows a login with a one-time password (OTP), from entering a mobile number to receiving a session token. It is for students learning UML sequence diagrams and developers planning phone-based passwordless login.
Example: Sequence diagram for login with a one-time password: click to open it in the editor and change it.
The participants
Four lifelines take part in the login. Each one has a clear job:
| Participant | Role in the flow |
|---|---|
| User | Types the mobile number and the received OTP |
| App | Front end that forwards requests and shows the result |
| Auth Service | Creates the OTP, verifies it and issues the session token |
| SMS Gateway | Delivers the OTP to the user's phone |
The messages in order
The diagram has eight messages. They split into two phases: requesting the code and verifying it.
- Enter mobile number: User → App (sync)
- Request OTP: App → Auth Service (sync)
- Send OTP: Auth Service → SMS Gateway (sync)
- OTP via SMS: SMS Gateway → User (return)
- Enter OTP: User → App (sync)
- Verify OTP: App → Auth Service (sync)
- Session token: Auth Service → App (return)
- Logged in: App → User (return)
Sync messages are requests that wait for a response. Return messages carry results back. The OTP never travels back through the App. The SMS Gateway sends it straight to the User, so the code reaches the person through a separate channel, their phone.
How to adapt it for your project
- Rename SMS Gateway to an email or authenticator service if you deliver codes another way.
- Add a failure path after Verify OTP, such as "Invalid or expired OTP". This diagram only shows the success case.
- Insert a database or cache lifeline if your Auth Service stores OTPs and expiry times.
- Add messages for resend limits or rate limiting before Request OTP.
- Open and edit it to match your own service names.
Tip: Keep the happy path readable. Put error handling in a separate alt fragment or a second diagram, rather than crowding these eight messages.
Frequently asked questions
What are the participants in an OTP login sequence diagram?
This diagram uses four: User, App, Auth Service and SMS Gateway. The Auth Service generates and checks the OTP, and the SMS Gateway delivers it.
How many messages does the OTP login flow have?
It has eight messages. Four cover requesting and delivering the OTP. The other four cover entering it, verifying it and returning a session token.
What does the Auth Service return after verifying the OTP?
It returns a Session token to the App. The App then tells the User they are Logged in.
Make your own sequence diagram with AI →