The most important trade-off is template ownership: keep password-reset copy and expiry rules in the edtech application, even if a messaging service renders or transports the SMS. TL;DR: when a provider has no delivery webhooks, polling improves operational visibility, but it must never decide whether a reset credential is valid. Your state machine should own issuance, verification, expiry, retry, and abuse controls. Provider status is delayed transport evidence, not authentication truth. ...