Português
English
The short answer: once the password is right, your site sends a code to the customer's already confirmed phone and only opens the session when the code matches. Anyone who stole or guessed the password is stuck at the door, because they do not have the phone. With our verification API it takes two requests, and the customer does not need to install any app.
How it fits into your login
|
|
|
|
|
Rules that work well for logins
| Choice | Why |
| 5 minutes validity (the default) | The customer has the phone in hand; a code for now is no use tomorrow. |
| 3 to 5 attempts | Enough for typos; too few for guessing. |
| A wait between resends | Set it in your account rules. Without it there is no limit on resends (see limits against abuse). |
| Text with your service name and “Do not share it” | For example: Your login code is {code}. Valid for {minutes} min. |
What your system decides
The API checks the code; the rules of your login are yours. Decide whether to ask for a code at every login or only on a new device, how long a device stays remembered, and what happens when the customer has lost the phone. That last case needs an answer before you switch the second step on: a recovery path that is not weaker than the code itself, such as contact with your team with an identity check.
| SMS is a good second step, not the only one. It can be read on a locked screen and, in an extreme case, diverted with a SIM swap. For high-value accounts, offer an authenticator app too. The differences are explained in sending one-time codes safely. |
| Tell the customer about each new login. A normal SMS saying “You just signed in to your account” lets them react if it was not them. Ideas for notices are in transactional SMS. |
|
Want to protect your site login with a second step by SMS? See Verification SMS. See Verification SMS |
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon) See plans |
