SMS OTP

Authsignal SDKs can be used to implement SMS OTP challenges in two scenarios.

Sign-in. Use our Server SDKs to authenticate users with SMS as the 1st factor. This integration only requires a phone number to initiate.
Adaptive MFA. Use Server SDKs together with Client SDKs to authenticate users with SMS as a secondary factor. This integration requires a user ID to initiate and assumes the user has already been authenticated with a primary factor.

SMS provider setup

Navigate to Authenticators in the Authsignal Portal, click on SMS OTP, and choose an SMS provider.

Log in to your Bird account
Get your Access key from your Bird account settings
Note your Workspace ID from your workspace settings
Create or locate an SMS channel and note the Channel ID
In the Authsignal Portal, select Bird as your SMS provider
Enter your Bird access key, workspace ID, and channel ID

Custom variables

When you deliver SMS codes using the Webhook provider, you can include custom data points in the sms.created webhook payload, such as a user’s account ID or a transaction amount. This is only supported for webhook delivery. Custom data points aren’t included in messages sent through a hosted SMS provider. To configure this, navigate to your SMS OTP settings in the Authsignal Portal and select which custom data points to include under Custom variables. Custom data points are prefixed by model type:

User data points are prefixed with user_ (e.g. user_accountId)
Action data points are prefixed with action_ (e.g. action_transactionAmount)

Custom data points must be registered in the Authsignal Portal before they can be selected. Only registered data points with values set on the user or action will be included.

SDK setup

Server SDK

Initialize the SDK using your secret key from the API keys page and the API URL for your region.

import { Authsignal } from "@authsignal/node";

const authsignal = new Authsignal({
  apiSecretKey: "YOUR_SECRET_KEY",
  apiUrl: "YOUR_API_URL",
});

using Authsignal;

var authsignal = new AuthsignalClient(
    apiSecretKey: "YOUR_SECRET_KEY",
    apiUrl: "YOUR_API_URL"
);

import com.authsignal.AuthsignalClient;

AuthsignalClient authsignal = new AuthsignalClient(
    "YOUR_SECRET_KEY",
    "YOUR_API_URL"
);

require 'authsignal'

Authsignal.setup do |config|
    config.api_secret_key = ENV["YOUR_SECRET_KEY"]
    config.api_url = "YOUR_API_URL"
end

from authsignal.client import AuthsignalClient

authsignal = AuthsignalClient(
    api_secret_key="YOUR_SECRET_KEY",
    api_url="YOUR_API_URL"
)

Authsignal::setApiSecretKey("YOUR_SECRET_KEY");
Authsignal::setApiUrl("YOUR_API_URL");

import "github.com/authsignal/authsignalgo/v2/client"

client := NewAuthsignalClient(
    "YOUR_SECRET_KEY",
    "YOUR_API_URL",
)

Client SDK

Initialize the Web SDK or Mobile SDK using your tenant ID from the API keys page and your API URL.

import { Authsignal } from "@authsignal/browser";

const authsignal = new Authsignal({
  tenantId: "YOUR_TENANT_ID",
  baseUrl: "YOUR_API_URL",
});

import Authsignal

let authsignal = Authsignal(
    tenantID: "YOUR_TENANT_ID",
    baseURL: "YOUR_API_URL"
)

import com.authsignal.Authsignal

val authsignal = Authsignal(
    tenantID = "YOUR_TENANT_ID",
    baseURL = "YOUR_API_URL",
)

import { Authsignal } from "react-native-authsignal";

const authsignal = new Authsignal({
  tenantID: "YOUR_TENANT_ID",
  baseURL: "YOUR_API_URL",
});

import 'package:authsignal_flutter/authsignal_flutter.dart';

final authsignal = Authsignal(
    "YOUR_TENANT_ID",
    baseURL: "YOUR_API_URL"
);

Scenario - Let users sign-in with SMS OTP as the 1st factor.

Our Server SDKs include methods to initiate and verify an OTP challenge for a given phone number. These methods are well-suited for passwordless sign-in scenarios where you need to authenticate a user based on their phone number.

1. Initiate challenge

Call Initiate Challenge to send an OTP to a phone number.

const request = {
  verificationMethod: "SMS",
  action: "signInWithSms",
  phoneNumber: "+64270000000",
};

const response = await authsignal.challenge(request);

const challengeId = response.challengeId;

var request = new ChallengeRequest(
    VerificationMethod: VerificationMethod.SMS,
    Action: "signInWithSms",
    PhoneNumber: "+64270000000"
);

var response = await authsignal.challenge(request);

var challengeId = response.ChallengeId;

ChallengeRequest request = new ChallengeRequest();
request.verificationMethod = VerificationMethodType.SMS;
request.action = "signInWithSms";
request.phoneNumber = "+64270000000";

ChallengeResponse response = authsignal.challenge(request).get();

String challengeId = response.challengeId;

response = Authsignal.challenge(
    verification_method: "SMS",
    action: "signInWithSms",
    phone_number: "+64270000000",
)

challenge_id = response[:challenge_id]

response, err := client.Challenge(
    ChallengeRequest{
        VerificationMethod: "SMS",
        Action: "signInWithSms",
        PhoneNumber: "+64270000000",
    },
)

challengeId := response.challengeId

You can choose a value for the action here which best describes what the user is doing in your app (e.g. signing in with SMS). It will be used to track user activity in the Authsignal Portal.

2. Verify challenge

Once the user inputs the OTP code, call Verify Challenge to verify it.

const request = {
  challengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
  verificationCode: "123456",
};

const response = await authsignal.verify(request);

const isVerified = response.isVerified;

var request = new VerifyRequest(
    ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    VerificationCode: "123456"
);

var response = await authsignal.Verify(request);

var isVerified = response.IsVerified;

VerifyRequest request = new VerifyRequest();
request.challengeId = "3a991a14-690c-492b-a5e5-02b9056a4b7d";
request.verificationCode = "123456";

VerifyResponse response = authsignal.verify(request).get();

boolean isVerified = response.isVerified;

response = Authsignal.verify(
    challenge_id: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    verification_code: "123456",
)

is_verified = response[:is_verified]

response, err := client.Verify(
    VerifyRequest{
        ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
        VerificationCode: "123456",
    },
)

isVerified := response.IsVerified

3. Claim challenge

Now that the challenge has been verified, you can lookup the user in your IdP or DB based on their phone number. For passwordless flows with a combined sign-up and sign-in UX, you may need to create the user at this point if no account exists. Then claim the challenge once you know the primary user ID associated with the phone number.

const request = {
  challengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
};

const response = await authsignal.claimChallenge(request);

var request = new ClaimChallengeRequest(
    ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833"
);

var response = await authsignal.ClaimChallenge(request);

ClaimChallengeRequest request = new ClaimChallengeRequest();
request.challengeId = "3a991a14-690c-492b-a5e5-02b9056a4b7d";
request.userId = "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833";

ClaimChallengeResponse response = authsignal.claimChallenge(request).get();

response = Authsignal.claim_challenge(
    challenge_id: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    user_id: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
)

response, err := client.ClaimChallenge(
    ClaimChallengeRequest{
        ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
        UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    },
)

This final step is important because it attributes activity to the correct user and ensures observability in the Authsignal Portal.

Adaptive MFA

Scenario - Challenge users with SMS OTP as a 2nd factor and use rules to decide when and where in your app to trigger the challenge.

The following steps demonstrate how to implement adaptive MFA with SMS OTP - either at sign-in or as step-up authentication when the user performs a sensitive action in your app (e.g. making a payment).

1. Track action

Use a Server SDK to track an action in your backend. This step can apply rules to determine if a challenge is required.

const request = {
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
  action: "signIn",
  attributes: {
    phoneNumber: "+64270000000",
  },
};

const response = await authsignal.track(request);

if (response.state === "CHALLENGE_REQUIRED") {
  // Obtain token to present challenge
  const token = response.token;
}

var request = new TrackRequest(
    UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    Action: "signIn",
    Attributes: new TrackAttributes(
        PhoneNumber: "+64270000000"
    )
);

var response = await authsignal.Track(request);

if (response.State == UserActionState.CHALLENGE_REQUIRED)
{
    // Obtain token to present challenge
    var token = response.Token;
}

TrackRequest request = new TrackRequest();
request.userId = "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833";
request.action = "signIn";
request.attributes = new TrackAttributes();
request.attributes.phoneNumber = "+64270000000";

TrackResponse response = authsignal.track(request).get();

if (response.state.equals(UserActionState.CHALLENGE_REQUIRED)) {
    // Obtain token to present challenge
    String token = response.token;
}

response = Authsignal.track({
  user_id: 'dc58c6dc-a1fd-4a4f-8e2f-846636dd4833',
  action: 'signIn',
  attributes: {
    phone_number: '+64270000000'
  }
})

case response[:state]
when "CHALLENGE_REQUIRED"
  # Obtain token to present challenge
  token = response[:token]
end

response = authsignal.track(
    user_id="dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    action="signIn",
    attributes={
        "phoneNumber": "+64270000000"
    }
)

if response["state"] == "CHALLENGE_REQUIRED":
    # Obtain token to present challenge
    token = response["token"]

$response = $authsignal->track([
    'userId' => 'dc58c6dc-a1fd-4a4f-8e2f-846636dd4833',
    'action' => 'signIn',
    'attributes' => [
        'phoneNumber' => '+64270000000'
    ]
]);

switch ($response['state']) {
    case 'CHALLENGE_REQUIRED':
        // Obtain token to present challenge
        $token = $response['token'];
}

response, err := client.Track(
    TrackRequest{
        UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
        Action: "signIn",
        Attributes: &TrackAttributes{
            PhoneNumber: "+64270000000",
        },
    },
)

switch response.State {
case "CHALLENGE_REQUIRED":
    // Obtain token to present challenge
    token := response.Token
}

You can choose a value for the action here which best describes what the user is doing in your app (e.g. signIn or createPayment). Each action can have its own set of rules. To learn more about using rules and handling different action states refer to our documentation on actions and rules.

2. Present challenge

If the action state is CHALLENGE_REQUIRED then you can present an SMS OTP challenge using the Web SDK or Mobile SDK.

Custom UI
Pre-built UI

// Set token from the track response
authsignal.setToken("eyJhbGciOiJ...");

// Send the user an SMS OTP code
// You can call this multiple times via a 'resend' button
await authsignal.sms.challenge();

// Verify the inputted code matches the original code
const response = await authsignal.sms.verify({ code: "123456" });

// Obtain a new token
const token = response.token;

// Set token from the track response
authsignal.setToken("eyJhbGciOiJ...")

// Send the user an SMS OTP code
// You can call this multiple times via a 'resend' button
await authsignal.sms.challenge()

// Verify the inputted code matches the original code
let response = await authsignal.sms.verify(code: "123456")

// Obtain a new token
let token = response.token

// Set token from the track response
authsignal.setToken("eyJhbGciOiJ...")

// Send the user an SMS OTP code
// You can call this multiple times via a 'resend' button
authsignal.sms.challenge()

// Verify the inputted code matches the original code
val response = authsignal.sms.verify(code = "123456")

// Obtain a new token
val token = response.token

// Set token from the track response
await authsignal.setToken("eyJhbGciOiJ...");

// Send the user an SMS OTP code
// You can call this multiple times via a 'resend' button
await authsignal.sms.challenge();

// Verify the inputted code matches the original code
const response = await authsignal.sms.verify({ code: "123456" });

// Obtain a new token
const token = response.token;

// Set token from the track response
await authsignal.setToken("eyJhbGciOiJ...");

// Send the user an SMS OTP code
// You can call this multiple times via a 'resend' button
await authsignal.sms.challenge();

// Verify the inputted code matches the original code
final response = await authsignal.sms.verify(code: "123456");

// Obtain a new token
final token = response.token;

// Launch the pre-built UI with the URL from the track response
const result = await authsignal.launch(url);

// Obtain a token to validate in the next step
if (result.token) {
  const token = result.token;
}

3. Validate action

Use the new token obtained from the client SDK to validate the action on your backend.

const response = await authsignal.validateChallenge({
  action: "signIn",
  token: "eyJhbGciOiJIUzI....",
});

if (response.state === "CHALLENGE_SUCCEEDED") {
  // User completed challenge successfully
}

var request = new ValidateChallengeRequest(
    Action: "signIn",
    Token: "eyJhbGciOiJIUzI...."
);

var response = await authsignal.ValidateChallenge(request);

if (response.State == UserActionState.CHALLENGE_SUCCEEDED) {
    // User completed challenge successfully
}

ValidateChallengeRequest request = new ValidateChallengeRequest();
request.action = "signIn";
request.token = "eyJhbGciOiJIUzI....";

ValidateChallengeResponse response = authsignal.validateChallenge(request).get();

if (response.state == UserActionState.CHALLENGE_SUCCEEDED) {
   // User completed challenge successfully
}

response = Authsignal.validate_challenge(action: "signIn", token: "eyJhbGciOiJIUzI....")

if response[:state] == "CHALLENGE_SUCCEEDED"
  # User completed challenge successfully
end

response = authsignal.validate_challenge(action="signIn", token="eyJhbGciOiJIUzI....")

if response["state"] == "CHALLENGE_SUCCEEDED":
    # User completed challenge successfully

$response = Authsignal::validateChallenge(action: "signIn", token: "eyJhbGciOiJIUzI....");

if ($response["state"] === "CHALLENGE_SUCCEEDED") {
    # User completed challenge successfully
}

response, err := client.ValidateChallenge(
    ValidateChallengeRequest{
        Action: "signIn",
        Token: "eyJhbGciOiJ...",
    },
)

if response.State == "CHALLENGE_SUCCEEDED" {
    // User completed challenge successfully
}

If the action state shows that the SMS OTP challenge was completed successfully, you can let the user proceed with the action.

Enrollment

Scenario - Enroll users in SMS OTP while they’re authenticated so it can be used later as a method for adaptive MFA.

To use SMS OTP for adaptive MFA, users must be enrolled with SMS OTP as an authentication method. This means their phone number has previously been verified and can be trusted. The following steps demonstrate how to implement an enrollment flow using a Server SDK.

1. Initiate challenge

Call Initiate Challenge to send an OTP to a phone number.

const request = {
  verificationMethod: "SMS",
  action: "enrollSms",
  phoneNumber: "+64270000000",
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
  scope: "add:authenticators",
};

const response = await authsignal.challenge(request);

const challengeId = response.challengeId;

var request = new ChallengeRequest(
    VerificationMethod: VerificationMethod.SMS,
    Action: "enrollSms",
    PhoneNumber: "+64270000000",
    UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    Scope: "add:authenticators",
);

var response = await authsignal.challenge(request);

var challengeId = response.ChallengeId;

ChallengeRequest request = new ChallengeRequest();
request.verificationMethod = VerificationMethodType.SMS;
request.action = "enrollSms";
request.phoneNumber = "+64270000000";
request.userId = "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833";
request.scope = "add:authenticators";

ChallengeResponse response = authsignal.challenge(request).get();

String challengeId = response.challengeId;

response = Authsignal.challenge(
    verification_method: "SMS",
    action: "enrollSms",
    phone_number: "+64270000000",
    user_id: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    scope: "add:authenticators",
)

challenge_id = response[:challenge_id]

response, err := client.Challenge(
    ChallengeRequest{
        VerificationMethod: "SMS",
        Action: "enrollSms",
        PhoneNumber: "+64270000000",
        UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
        Scope: "add:authenticators",
    },
)

challengeId := response.challengeId

The add:authenticators scope is required to enroll a new SMS authenticator for an existing user. This scope should only be used when the user is in an already authenticated state. For more information on using scopes safely refer to our documentation on authenticator binding.

2. Verify challenge

Once the user inputs the OTP code, call Verify Challenge to verify it.

const request = {
  challengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
  verificationCode: "123456",
};

const response = await authsignal.verify(request);

const isVerified = response.isVerified;

var request = new VerifyRequest(
    ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    VerificationCode: "123456"
);

var response = await authsignal.Verify(request);

var isVerified = response.IsVerified;

VerifyRequest request = new VerifyRequest();
request.challengeId = "3a991a14-690c-492b-a5e5-02b9056a4b7d";
request.verificationCode = "123456";

VerifyResponse response = authsignal.verify(request).get();

boolean isVerified = response.isVerified;

response = Authsignal.verify(
    challenge_id: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    verification_code: "123456",
)

is_verified = response[:is_verified]

response, err := client.Verify(
    VerifyRequest{
        ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
        VerificationCode: "123456",
    },
)

isVerified := response.IsVerified

Update phone number

Scenario - Let users update their phone number while they’re authenticated, completing an OTP challenge to verify the new number.

The following steps demonstrate how to implement an update phone number flow using a Server SDK.

1. Initiate challenge

Call Initiate Challenge to send an OTP to the user’s new phone number.

const request = {
  verificationMethod: "SMS",
  action: "updatePhoneNumber",
  phoneNumber: "+64270000000",
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
  scope: "update:authenticators",
};

const response = await authsignal.challenge(request);

const challengeId = response.challengeId;

var request = new ChallengeRequest(
    VerificationMethod: VerificationMethod.SMS,
    Action: "updatePhoneNumber",
    PhoneNumber: "+64270000000",
    UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    Scope: "update:authenticators",
);

var response = await authsignal.challenge(request);

var challengeId = response.ChallengeId;

ChallengeRequest request = new ChallengeRequest();
request.verificationMethod = VerificationMethodType.SMS;
request.action = "updatePhoneNumber";
request.phoneNumber = "+64270000000";
request.userId = "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833";
request.scope = "update:authenticators";

ChallengeResponse response = authsignal.challenge(request).get();

String challengeId = response.challengeId;

response = Authsignal.challenge(
    verification_method: "SMS",
    action: "updatePhoneNumber",
    phone_number: "+64270000000",
    user_id: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    scope: "update:authenticators",
)

challenge_id = response[:challenge_id]

response, err := client.Challenge(
    ChallengeRequest{
        VerificationMethod: "SMS",
        Action: "updatePhoneNumber",
        PhoneNumber: "+64270000000",
        UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
        Scope: "update:authenticators",
    },
)

challengeId := response.challengeId

The update:authenticators scope is required to update a user’s existing SMS authenticator to change the phone number. This scope should only be used when the user is in an already authenticated state. For more information on using scopes safely refer to our documentation on authenticator binding.

2. Verify challenge

Once the user inputs the OTP code, call Verify Challenge to verify it.

const request = {
  challengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
  verificationCode: "123456",
};

const response = await authsignal.verify(request);

const isVerified = response.isVerified;

var request = new VerifyRequest(
    ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    VerificationCode: "123456"
);

var response = await authsignal.Verify(request);

var isVerified = response.IsVerified;

VerifyRequest request = new VerifyRequest();
request.challengeId = "3a991a14-690c-492b-a5e5-02b9056a4b7d";
request.verificationCode = "123456";

VerifyResponse response = authsignal.verify(request).get();

boolean isVerified = response.isVerified;

response = Authsignal.verify(
    challenge_id: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
    verification_code: "123456",
)

is_verified = response[:is_verified]

response, err := client.Verify(
    VerifyRequest{
        ChallengeId: "3a991a14-690c-492b-a5e5-02b9056a4b7d",
        VerificationCode: "123456",
    },
)

isVerified := response.IsVerified

Verified phone numbers

Scenario - Enroll or update an SMS authenticator for a user when you’ve already verified their phone number in another system, so it can be used later as a method for adaptive MFA.

In some cases you may have already verified a user’s phone number using another system. This means the user can be enrolled without having to complete an SMS OTP challenge.

const request = {
  userId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
  attributes: {
    verificationMethod: "SMS",
    phoneNumber: "+64270000000",
  },
};

const response = authsignal.enrollVerifiedAuthenticator(request);

var request = new EnrollVerifiedAuthenticatorRequest(
    UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    Attributes: new EnrollVerifiedAuthenticatorAttributes(
        VerificationMethod: VerificationMethod.SMS,
        PhoneNumber: "+64270000000"
    )
);

var response = await authsignal.EnrollVerifiedAuthenticator(request);

EnrollVerifiedAuthenticatorRequest request = new EnrollVerifiedAuthenticatorRequest();
request.userId = "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833";
request.attributes = new EnrollVerifiedAuthenticatorAttributes();
request.attributes.verificationMethod = VerificationMethodType.SMS;
request.attributes.phoneNumber = "+64270000000";

authsignal.enrollVerifiedAuthenticator(request).get();

Authsignal.enroll_verified_authenticator(
    user_id: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    attributes:{
        verification_method: "SMS",
        phone_number: "+64270000000"
    }
)

response = authsignal.enroll_verified_authenticator(
    user_id="dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    attributes={
        "verificationMethod": "SMS",
        "phoneNumber": "+64270000000"
    }
)

$response = Authsignal::enrollVerifiedAuthenticator([
    'userId' => "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
    'attributes' => [
        "verificationMethod" => "SMS",
        "phoneNumber" => "+64270000000"
    ]
]);

response, err := client.EnrollVerifiedAuthenticator(
    EnrollVerifiedAuthenticatorRequest{
        UserId: "dc58c6dc-a1fd-4a4f-8e2f-846636dd4833",
        Attributes: &EnrollVerifiedAuthenticatorAttributes{
            VerificationMethod: "SMS",
            PhoneNumber: "+64270000000",
        },
    },
)

This same call can also be used to update a verified phone number to a new value which has also been verified externally.

Next steps

Pre-built UI - Rapidly deploy SMS OTP challenges using our pre-built UI
Web SDK - Implement SMS OTP challenges while building your own UI
Mobile SDK - Implement SMS OTP challenges in native mobile apps
Adaptive MFA - Set up smart rules to trigger authentication based on risk
Opt-in consent - Collect user consent before sending SMS messages
Passkeys - Offer the most secure and user-friendly passwordless authentication

Getting started

Integrations

Authentication methods

Implementation options

Actions & rules

Users

Advanced usage

SMS provider setup

Custom variables

SDK setup

Server SDK

Client SDK

1. Initiate challenge

2. Verify challenge

3. Claim challenge

Adaptive MFA

1. Track action

2. Present challenge

3. Validate action

Enrollment

1. Initiate challenge

2. Verify challenge

Update phone number

1. Initiate challenge

2. Verify challenge

Verified phone numbers

Next steps

​SMS provider setup

​Custom variables

​SDK setup

​Server SDK

​Client SDK

​Sign-in

​1. Initiate challenge

​2. Verify challenge

​3. Claim challenge

​Adaptive MFA

​1. Track action

​2. Present challenge

​3. Validate action

​Enrollment

​1. Initiate challenge

​2. Verify challenge

​Update phone number

​1. Initiate challenge

​2. Verify challenge

​Verified phone numbers

​Next steps

SMS provider setup

Custom variables

SDK setup

Server SDK

Client SDK

Sign-in

1. Initiate challenge

2. Verify challenge

3. Claim challenge

Adaptive MFA

1. Track action

2. Present challenge

3. Validate action

Enrollment

1. Initiate challenge

2. Verify challenge

Update phone number

1. Initiate challenge

2. Verify challenge

Verified phone numbers

Next steps