The problem
Password logins created friction and a steady stream of password-recovery support requests.
Constraints
Identity lived in a Keycloak instance shared by several products, so changes had to work for all of them.
Other teams owned parts of the platform the login flow depended on.
The decision
Implement email OTP inside Keycloak's own authentication flow (start login, then verify the code) rather than building a separate auth service next to it.
The trade-off
Email delivery becomes part of the login path. A slow inbox is now a slow login.
Accepted over running a second source of truth for identity.
Outcome
Login became simpler for customers.
Support requests about password recovery went down.