Why Voice OTP is a carrier-redundant fallback
An SMS one-time passcode is the default because it needs no app, no data connection and no inbox. It also has a single point of failure: the message itself. When a carrier is congested, when a number is DND-screened, or when a handset is out of coverage, the code can sit undelivered exactly when a user is waiting to log in. The user cannot act, and you find out only from a support ticket.
Voice OTP exists to give that moment a second path.
A different failure domain
An automated call that reads the code does not depend on the SMS pipeline. It is delivered by a voice carrier over the circuit-switched network rather than as a message, so a congested SMS route is not, by itself, a reason the user cannot authenticate. The audio reaches the phone and says the code out loud; there is nothing to open and nothing to miss.
That difference is the whole point. A fallback that shared the SMS pipeline's failure mode would not be a fallback.
Carrier redundancy, not just channel redundancy
Voice is not a single carrier either. Nerve places calls through a chain — Termii, then Infobip — and each carrier has its own circuit breaker. When the first carrier fails, refuses the call, or accepts the connection and never answers, the next one places it within the same dispatch.
Each attempt is bounded by a short five-second budget. A spoken passcode is only useful while the user is still watching the login screen, so waiting out a stalled carrier is worse than failing over quickly. By the time you read a receipt, one of the carriers has answered or both have been tried.
The result is redundancy at two layers: a second channel when SMS does not arrive, and a second carrier when the first voice carrier does not connect.
Why it is opt-in, not automatic
Making voice the default would be wrong on two counts:
- Cost. A call costs roughly three times an SMS. A voice call on every login would quietly multiply your authentication bill.
- It rings a phone. A voice channel is a stronger interruption than a text. It belongs on the login that your monitoring says is failing, not on every login.
So Nerve will not infer voice from a recipient having a phone number. You ask
for it per event by supplying overrides.voice, and only then does the call
become a candidate channel.
Once it is a candidate, its place in the order is deliberate. For a CRITICAL
or HIGH event, reachability wins and voice leads: a ringing phone is the
hardest notification to miss. For a routine event, cost wins and voice trails,
so it is a fallback rather than a first choice. Either way you can set the
priority that decides it — see Priorities and
routing.
Failure is explicit, never a spoken hole
The other design constraint is what happens when the script is wrong. A
template that renders "your code is " and reads it aloud is worse than no call:
it rings the recipient, spends the carrier charge, and tells them nothing.
Voice scripts therefore fail closed. If a {{placeholder}} has no value,
the call is not placed and the event is recorded as failed with the missing
keys named in the receipt. See the Voice
reference.
Nigerian DND screening applies here too. A promotional voice event to a DND-screened number is suppressed, while a transactional Voice OTP fails open so a lookup outage never blocks an authentication flow — the same posture as SMS.
When to reach for it
Use Voice OTP when the cost of a failed login is higher than the cost of a call: authentication on a critical path, a user who has repeatedly failed to receive an SMS, or a market where SMS delivery is known to be unreliable. For routine notifications, SMS or push remains the cheaper, appropriate default.