Phone authentication for your app

Let users sign in to your app with their phone number and an SMS one-time code, using your own SMS provider.

<head> <script type=“application/ld+json”> {{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Is there a managed option for phone sign-in like Google sign-in has?", "acceptedAnswer": {"@type": "Answer", "text": "No. Phone sign-in always uses your own SMS provider credentials. If you don't want to set up an SMS provider, consider email or Google sign-in instead."}}, {"@type": "Question", "name": "Who pays for the SMS messages?", "acceptedAnswer": {"@type": "Answer", "text": "Your SMS provider bills you directly for every message sent, under your own Twilio, Vonage, MessageBird, or TextLocal account. RShift Sites does not charge for SMS delivery."}}, {"@type": "Question", "name": "Why are sign-in codes not arriving?", "acceptedAnswer": {"@type": "Answer", "text": "Check your SMS provider's dashboard first: failed deliveries, an exhausted balance, or sender restrictions in the recipient's country show up there. Also confirm the provider credentials in your auth settings are current."}}, {"@type": "Question", "name": "Which SMS provider should I choose?", "acceptedAnswer": {"@type": "Answer", "text": "Any supported provider works: Twilio, Twilio Verify, TextLocal, Vonage, or MessageBird. Pick based on pricing and delivery coverage in the countries where your users are. Twilio Verify manages the verification message for you, while the others send the SMS template you define."}}, {"@type": "Question", "name": "Can users sign in with both email and phone?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Sign-in methods are independent: you can enable phone alongside email, Google, Apple, and others, and users choose how to sign in."}}, {"@type": "Question", "name": "Does phone sign-in work internationally?", "acceptedAnswer": {"@type": "Answer", "text": "Delivery depends on your SMS provider's coverage and each country's rules about who may appear as the SMS sender. Check your provider's coverage documentation for the regions where your users are."}}]}} </script> </head>

Let users sign in to your app with their phone number: they enter it, receive a one-time code by SMS, and type the code to sign in. There are no passwords to remember and no email inbox involved.

Unlike Google and Apple sign-in, phone authentication has no managed mode: SMS delivery always runs through your own account with an SMS provider, and the provider bills you directly for messages.

Works for audiences where email is uncommon or rarely checked
Suits mobile-first products where typing a phone number is natural
No passwords to create, forget, or reset
The phone number doubles as a verified contact channel for your app

Common use cases

Phone sign-in is commonly used for:

Marketplace and delivery apps where sellers and couriers coordinate by phone
Local-services and booking apps with walk-in customers
Apps for regions where phone numbers are the primary online identity
Internal field tools for staff without company email addresses

Create an account with an SMS provider

Phone sign-in requires an account with one of the supported providers. Create one and collect its credentials from the provider’s console:

Provider	Credentials you enter
Twilio	Account SID, Auth token, Content SID, Message service SID
Twilio Verify	Account SID, Auth token, Verify service SID
TextLocal	API key, Sender (6 characters max)
Vonage	API key, API secret, From (sender number)
MessageBird	Access key, Originator (11 characters max)

Pick a provider based on pricing and delivery coverage in the countries where your users are.

Enable and configure phone sign-in in RShift Sites

Go to More → Cloud → Users → Auth settings → Phone, turn on Enable phone sign-in, select your Active SMS provider, and enter its credentials.

Add the sign-in flow to your app

Ask RShift Sites to build the phone sign-in UI:

    Let users sign in with their phone number using an SMS code.

Test the flow

Sign in with a real phone number and verify that the code arrives, the code screen accepts it, and the new user appears in More → Cloud → Users.

Configuration

These settings control the sign-in flow:

SMS template: the message text sent to users. Use {{ .Code }} where the one-time code should appear.
SMS OTP expiration (seconds): how long a code stays valid, from 60 to 600 seconds.
SMS OTP length: 4 to 8 digits.
Auto-confirm SMS: sign users in without OTP verification. Useful while testing, but leave it off in production, since it removes the proof that the user owns the phone number.

Costs

RShift Sites does not charge for SMS delivery. Your SMS provider bills your account directly for every message sent, at the provider’s own rates. High signup volume means high SMS volume, so keep an eye on your provider’s usage dashboard as your app grows.

Troubleshooting

Sign-in codes are not arriving

Check your SMS provider’s dashboard first: failed deliveries, an exhausted balance, or sender restrictions in the recipient’s country (rules about which names or numbers are allowed to appear as the SMS sender) show up there. Also confirm the provider credentials in your auth settings are current.

Codes arrive but are rejected

The code may be expiring before users can type it. Raise SMS OTP expiration (seconds) in the phone settings, and confirm users are entering the most recent code, since re-requesting a code invalidates earlier ones.

Delivery works in one country but not another

Countries have different rules about which names or numbers may appear as the SMS sender, and some require senders to be registered in advance. Check your provider’s coverage and compliance documentation for the affected country.

FAQ

Is there a managed option like Google sign-in has?

No. Phone sign-in always uses your own SMS provider credentials. If you don’t want to set up an SMS provider, consider email or Google sign-in instead.

Who pays for the SMS messages?

Your SMS provider bills you directly for every message sent, under your own Twilio, Vonage, MessageBird, or TextLocal account. RShift Sites does not charge for SMS delivery.

Which SMS provider should I choose?

Any supported provider works. Pick based on pricing and delivery coverage in the countries where your users are. Twilio Verify manages the verification message for you, while the other providers send the SMS template you define.

Can users sign in with both email and phone?

Yes. Sign-in methods are independent: you can enable phone alongside email, Google, Apple, and others, and users choose how to sign in.

Does phone sign-in work internationally?

Delivery depends on your SMS provider’s coverage and each country’s rules about who may appear as the SMS sender. Check your provider’s coverage documentation for the regions where your users are.