Skip to main content

SMS Passcode Authenticator

In the SMS Passcode flow, consumers receive a One-Time Passcode (OTP) on their registered phone number, which is used during the second step of Multi-Factor Authentication (MFA).

Flow Diagram:

MFA-by-SMS-Passcode

MFA SMS OTP configuration

  1. LoginRadius Console configuration for SMS OTP is guided in the following document.
  2. To configure Twilio or another SMS provider, refer to the following document

SMS API Implementation

Follow the steps below to implement MFA via our MFA API, which uses a mix of front-end and back-end API calls.

Note: If an API call requires an API Secret, it should be called from the back end. Otherwise, the API call can also be used on the front end.

Set up the initial login using one of the following MFA-enabled APIs:

  • MFA Email Login API: To have a Standard Login flow requiring email and password.
  • MFA UserName Login API: Use UserName and Password instead of Email and Password.
  • MFA Phone Login: If your API has been configured for Phone-based Authentication, use this API to authenticate the user via phone.
    After successful authentication, the response includes details for MFA, including Sms OTP status and available questions:
{
  SecondFactorAuthentication": {
"SecondFactorAuthenticationToken": "32ba53ff-XXXX-XXX-XXX-XXXXXXXXXXXX",
"ExpireIn": "2017-08-31T01:39:28.1427384Z",
"QRCode": "http://chart.googleapis.com/chart?cht=XXXXXXXXXXXXX",
"ManualEntryCode": "XXXXXXXXXXXXXXXXXXXX",
    "IsGoogleAuthenticatorVerified": false,
    "IsEmailOtpAuthenticatorVerified": false,
    "IsOTPAuthenticatorVerified": false,
    "OTPPhoneNo": null,
    "OTPStatus": null,
    "Email": [
      "x**z@e****le.c*m"
    ],
    "EmailOTPStatus": {
      "Email": "x**z@e****e.c*m"
    },
    "IsSecurityQuestionAuthenticatorVerified": false,
    "SecurityQuestions": [
      {
        "QuestionId": "<QuestionId>",
        "Question": "<Question>"
      }
    ]
  },
  "Profile": null,
  "access_token": "00000000-0000-0000-0000-000000000000",
  "expires_in": "0001-01-01T00:00:00"
}

If IsOTPAuthenticatorVerified is false or null, the consumer has not yet verified a phone number. Prompt them to verify using the Update Phone Number API.