- Never a row of single-character Inputs. Paste and SMS autofill must fill the whole field at once.
- State the length and the channel in the copy, and set
autocomplete="one-time-code".
- Submit on completion with the explicit submit still present; a failed auto-submit does not clear the field.
- A wrong code shows remaining attempts, then lockout with a recovery path.