SMS Verification

SMS Verification is a multi-factor authentication method. After it is enabled, users must enter a one-time verification code sent to their bound phone number after entering the correct account and password. This adds an extra layer of protection to the account.

Path: Console → open the target application → top navigation Configuration → Security Settings → Multi-factor Authentication

 

1. Application Configuration

1.1 Enable SMS Verification

• In the Factor Management section, find the SMS Verification card and turn on the switch on the right.

• After it is enabled, users under the current application must complete secondary verification when they log in with a password. Third-party login and verification-code login are not affected.

• If the application uses RootAuth built-in SMS, SMS Verification is enabled directly and RootAuth shows SMS verification factor enabled successfully.

• If a custom SMS provider has been configured, you need to enter the template ID for Login secondary verification when enabling SMS Verification. RootAuth saves the template configuration and enables the factor.

Tip: SMS Verification, Email Verification, and OTP can be enabled or disabled independently.

 

1.2 Disable SMS Verification

• Turn off the SMS Verification switch.

• Before disabling the factor, RootAuth shows a confirmation dialog. After you confirm, the factor is disabled and RootAuth shows SMS verification factor disabled successfully.

• After SMS Verification is disabled, password login no longer triggers SMS-based secondary verification.

Disabling SMS Verification does not delete users' bound phone numbers or saved SMS service and template configurations.

 

1.3 Configure SMS Templates (Optional)

When SMS Verification is enabled, you can configure the SMS template used for login secondary verification.

• Path: Branding → SMS → Domestic SMS Service / International SMS Service.

• In the provider configuration, find the template ID field for Login secondary verification.

• If you use built-in SMS, no template ID is required. RootAuth uses its built-in SMS template.

• If you use Alibaba Cloud SMS, Tencent Cloud SMS, or Ucloud SMS, enter the corresponding template ID for the current provider.

Note: If you enable SMS Verification before configuring a custom SMS provider, the Login secondary verification template ID is required. Otherwise, SMS MFA may not be able to send verification codes.

 

1.4 Configure Phone Number Region Code Policy

SMS Verification uses the user's phone number. When a user binds a phone number for the first time, the region code dropdown follows the Allowed login region codes setting in Login Control.

• Path: Application Management → Login Control → Phone number region code policy.

• If a user has not bound a phone number, they can only select a region code allowed by the login region code policy when completing SMS MFA for the first time.

• Region codes are displayed in the format +code Country/Region, such as +86 China.

 

2. User Verification Flow

2.1 Prerequisites

• SMS Verification is enabled for the application.

• The user logs in with an account and password.

• The SMS service configuration of the current application can send verification codes successfully.

 

2.2 First-Time Phone Number Binding

1. The user enters the correct account and password on the application login page and clicks login.

2. After RootAuth verifies the credentials, the user is redirected to the Login Secondary Verification page.

3. If the user has not bound a phone number, the page asks the user to enter a phone number and request a verification code.

4. The user selects a region code, enters a phone number, and clicks Get Verification Code.

5. The user enters the SMS verification code and clicks Confirm.

6. After verification succeeds, the phone number is bound and the user is logged in and redirected to the application callback URL.

 

2.3 Verification Flow for Bound Phone Numbers

1. The user enters the correct account and password on the application login page and clicks login.

2. After RootAuth verifies the credentials, the user is redirected to the Login Secondary Verification page.

3. The page displays the user's masked phone number, such as +86 134****9804.

4. The user clicks Get Verification Code, and RootAuth sends an SMS code to the bound phone number.

5. The user enters the verification code and clicks Confirm.

6. After verification succeeds, the user is logged in and redirected to the application callback URL.

If multiple factors are enabled: users can switch between available methods on the secondary verification page. The display order is OTP Verification, Email Verification, and Phone Number Verification.

 

2.4 Resend Verification Code

• If the user does not receive the SMS within 60 seconds or the code expires, they can request another code.

• The button enters a 60-second countdown and can be clicked again after the countdown ends.

 

2.5 Verification Code Rules

• If the same IP sends more than 60 verification codes within 1 hour, the security policy is triggered.

• After the policy is triggered, RootAuth shows: Verification codes are being sent too frequently. Please try again after 24 hours.

• If the user enters incorrect verification codes 6 consecutive times across enabled factors, the account cannot log in for 1 hour.

 

3. User Details Management

Administrators can view a user's SMS Verification binding status on the user details page.

Path: User Management → Users → open a user → find the Multi-factor Authentication section

• View: If the user has completed SMS Verification, this section displays the masked phone number.

• Reset: SMS Verification currently cannot be reset from this section.

• Global MFA bypass switch: this switch is shared by all verification methods. After it is turned off, the user bypasses all MFA. After it is turned on again, the user follows the application's MFA configuration.

The phone number itself is not deleted when SMS Verification is disabled. To change a user's phone number, edit it in the basic information section of the user details page.

 

4. Logs and Auditing

After SMS Verification is enabled, user behavior logs record related events:

• Event type: Secondary authentication - SMS

• Recorded fields: user, IP, country, time, result (success/failure), and failure reason.

You can view these records in Audit Logs → User Behavior Logs.