I once built an IdP that vended access one time codes via email. We had to switch to other means because there were a small (but significantly high) fraction of customers who didn’t receive their OTPs before they expired (TTL was 15 minutes). Also even if they came in before the TTL, a user experience that involved waiting that long to get logged in was not tenable.
