SMS sign-in
Players enter their mobile number on the hosted login page and type the six-digit code they receive by text message. SMS is off until you turn it on for an application.
Turn it on
SMS codes are set per application, because every message costs money and is a target for toll fraud. Browser and game applications can use them.
- Open the project in the console and go to Applications.
- Select the browser or game application.
- Under SMS sign-in, tick Allow sign-in with SMS codes.
- Under Countries that can receive codes, tick only the countries your players are in. At least one is required.
- Select Save SMS settings.
If the console says SMS delivery is not set up for the environment, the setting is saved but the hosted login page doesn't offer SMS until delivery is turned on.
What players see
- The player selects Continue with a text message and enters their number with its country code, for example +44 7700 900123.
- A number from a country you haven't allowed is refused before anything is sent, and the page suggests another sign-in method.
- auth4.dev texts a six-digit code. It expires after ten minutes.
- The player can ask for a new code after 60 seconds. A new code replaces the earlier one.
- After at most five wrong guesses the code stops working and the player must request a new one.
- On success, the player sees the scopes your application requests and approves them.
The first verified sign-in with a new number creates a player account. With sign-up turned off for the project, unknown numbers get the same "invalid code" response as a wrong code.
For a game application, Continue with a text message appears on the device approval page; after the code, the player approves the device. On the guest upgrade page, Link a mobile number saves a guest's progress to the number. A number that already belongs to another player isn't linked, and accounts are never merged.
The text message
The wording is fixed and doesn't name your application, because a text message can't prove who sent it. The last line binds the code to the auth4.dev sign-in page, so browsers that support it offer the code only there.
Rate limits
Sending is limited to protect your players and to stop SMS pumping:
| Limit | Value |
|---|---|
| Per sign-in attempt and number | 1 message per 60 seconds |
| Per number | 3 messages per hour in a project, 6 per day overall |
| Per IP address | 5 messages per hour in a project, 15 per day overall |
| Per IP address | 20 code guesses per hour |
| Per project | 100 messages per hour and 500 per day |
When a limit is hit the hosted page shows a "try again later" message. Your application doesn't need to handle it.
What is stored
The verified number is stored in E.164 form as the player's sign-in identity, in your project only. Codes are stored only as keyed hashes in short-lived state and are never logged. Audit events for SMS settings record whether SMS is on and how many countries are allowed, not which ones.