Phone authentication

Allow users to use their phone as a primary method for authentication. This is a passwordless method, where the user is sent a verification code via SMS (or WhatsApp when configured). SMS can also be included as a secondary factor if you have multi-factor authentication set up.

What you need

Link to this section

• A Kinde account. You can use Kinde default SMS on any plan, including in live environments.
• To connect your own SMS provider (recommended): a Kinde paid plan and a third-party SMS provider account (Twilio and Sinch Engage are currently supported).

Initial configuration

Link to this section

1. Sign in to your Kinde account and go to Settings > Environment > Messaging.

2. Select the SMS tab.

   

3. In the Details section, select the Default country.

   This is the country code shown by default on the authentication page when a user signs in.

4. In the SMS provider section, select a Provider.

See below for additional configuration steps.

Kinde default SMS

Link to this section

By default, Kinde sends authentication SMS from its own shared service. You can use this in live environments on every plan. You do not need a third-party SMS provider to go live.

• On the Free plan, Kinde default SMS is limited to 10 SMS per month.
• On Paid plans (Pro, Plus, Scale), Kinde default SMS is not capped. Usage is billed per message — see Kinde pricing.

Bring your own SMS provider (recommended)

Link to this section

Connecting your own SMS provider requires a Kinde paid plan.

We recommend connecting your own SMS provider for best deliverability, and so you can control the Sender ID or From number. Your own provider is uncapped and is not billed by Kinde. This is a recommended approach, but not a requirement.

Kinde currently supports the following SMS providers:

• Twilio
• Sinch Engage

Why use a third-party SMS service instead of Kinde?

• Gives you full control over the SMS delivery nuances, such as Sender ID, country registrations, and detailed delivery metrics.
• You can register dedicated short codes or sender IDs in countries that have strict SMS sending regulations like Ireland, New Zealand, and Canada, which will greatly improve deliverability.
• Access to delivery logs and other service quality details for troubleshooting.

Configure Twilio

Link to this section

1. Get Twilio credentials

Link to this section

1. Sign in to your Twilio dashboard and get the following credentials from your Console:

   • The Account SID

   • The Auth Token

   • Your Twilio phone number or the Messaging Service SID (if you set one up)

     

See the Twilio SMS documentation for detailed setup steps.

2. Enable Twilio in Kinde

Link to this section

1. Select Twilio in the Provider dropdown. Twilio settings appear.

   

2. Enter the Account SID and Auth token from your Twilio account.

   

3. In the SMS source field, select either Use message service or Use “From number”. Kinde sends verification codes from the source you choose.

   Twilio Messaging Services are suitable for global applications because they can select an appropriate sender based on where the user signs in.

4. Enter the value that matches the SMS source you selected:

   • For Use message service, enter the Messaging Service SID.
   • For Use “From number”, enter your Twilio-issued phone number, including the country code and no spaces (maximum 14 characters).

5. Select Save.

For security, Kinde never displays a stored secret after you select Save. See Third-party secret storage for more information.

After configuring Twilio, enable phone authentication for your applications.

Configure Sinch Engage

Link to this section

1. Get Sinch Engage credentials

Link to this section

1. Sign in to your Sinch Engage (formerly MessageMedia) dashboard.

2. Go to Settings > API Settings and create a new API key.

3. Copy both the API key and API secret.

   Sinch only shows the secret once, when the key is created, so copy and store it somewhere safe.

4. Take note of the region your Sinch Engage account is hosted in — Asia Pacific (default) or Europe.

   Account region is where your Sinch Engage account is hosted — it selects the regional API endpoint Kinde calls. It is not a restriction on where you can send messages. From either region you can send to phone numbers in any country, subject to your provider’s registration requirements for those countries. The legacy MessageMedia endpoint (api.messagemedia.com) is not used.

2. Enable Sinch Engage in Kinde

Link to this section

1. Select Sinch Engage in the Provider dropdown. Sinch Engage settings appear.

   

2. Enter the API key and API secret from your Sinch Engage account.

   

3. Select your Account region — either Asia Pacific (au.app.api.sinch.com) or Europe (eu.app.api.sinch.com). Messages are sent through this region’s API endpoint, so it must match the region your Sinch Engage account is hosted in.

4. Optionally enter a Source number. Leave it blank to use your account default. For an international number, use E.164 format: a leading +, then country code and number with no spaces (for example +61412345678). Use the same value as registered in Sinch Engage. For an alphanumeric sender or short code, enter the value exactly as registered with Sinch Engage.

5. If you entered a source number, set Source number type to one of the following:

   

   • Detect automatically
   • International (E.164 phone number)
   • Alphanumeric
   • Short code

6. Select Save.

For security, Kinde never displays a stored secret after you select Save. See Third-party secret storage for more information.

After configuring Sinch Engage, enable phone authentication for your applications.

Dedicated source numbers are not enabled by default on Sinch Engage accounts and must be registered with Sinch first. If you enter a source number that is not registered to your account, messages will fail to send.

Source number type is only used when a Source number is set. Selecting a specific source number type while leaving the source number blank will fail validation.

Sinch Engage’s automatic detection of the source number type can be inaccurate for alphanumeric and short code sources. If your messages are not arriving and you use one of those source types, set the Source number type explicitly instead of leaving it on automatic.

Enable phone authentication

Link to this section

1. In the Kinde dashboard, select View details on your preferred application tile.

2. Select Authentication from the left menu.

3. Enable Code from the Phone connections section.

   

4. Select Save.

You can also enable the connection for multiple applications at once:

1. Go to Settings > Environment > Authentication.

2. In the Phone connections section, select Configure on the Code tile. A connection popup appears.

   

3. Check each of the applications you want to enable phone authentication for.

   

4. Select Save.

You can also find the connection ID in this popup. The connection ID is useful when you build a custom authentication experience. You need the ID to trigger the phone authentication workflow.

Additional configuration

Link to this section

Set Kinde as fallback SMS provider

Link to this section

When a third-party SMS provider is configured, you can set Kinde as a fallback service. Delivery through the fallback provider cannot be guaranteed.

1. Sign in to your Kinde account and go to Settings > Environment > Messaging.

2. Select the SMS tab.

3. Scroll down to the end of the page and enable Allow Kinde to use fallback SMS provider.

   

4. Select Save.

   Kinde SMS is billed separately

   The fallback service uses Kinde’s own SMS provider, so any message it sends is billed to your Kinde account at standard rates. Leave the fallback switched off if you do not want that. See Kinde default SMS provider usage count and pricing.

Switch on SMS for MFA

Link to this section

You can use the same SMS provider for sending MFA (Multi-factor authentication) messages.

To make SMS available as an MFA method:

1. Go to Settings > Environment > Multi-factor auth.

2. Under Require multi-factor authentication, select Yes or Optional. More settings appear.

   

3. Under Additional authentication methods, switch on SMS.

   

4. Select Save.

Learn more about multi-factor authentication.

If you are using Kinde default SMS provider, the MFA SMS usage is counted towards your total SMS usage. See Kinde default SMS provider usage count and pricing.

Glossary

Link to this section

Kinde default SMS provider usage count and pricing

Link to this section

• Free plan: 10 SMS per month.
• Paid plans (Pro, Plus, Scale): SMS is billed per message with no monthly cap — see Kinde pricing.
• MFA (Multi-factor authentication) SMS usage is counted towards the same Free plan limit of 10 SMS per month. On paid plans, MFA SMS is billed per message at the same rate.

SMS message format

Link to this section

We use this standard format to make translation easier.

OTP message format

123456 is your one-time code to sign in to
xxxx@login.xxx.au #123456

You can’t customize the code message that users receive.

A2P messaging requirements

Link to this section

Phone authentication interactions are also known as A2P (Application to Person) messaging. Before you implement A2P, check whether you need to register your business for 10DLC (10 Digit Long Code) support. Registration is required in some locations.

Whichever provider you choose, carefully follow their procedures for registration, and their SMS policies for all relevant countries.

Third-party secret storage

Link to this section

For security, Kinde never displays a stored secret. The secret field for your provider — Auth token for Twilio, API secret for Sinch Engage — is always blank when you return to the page.

• If the provider is already selected, leave the field blank to keep the secret you saved earlier. Enter a value only when you want to replace it.
• If you are switching to a different provider, you must enter that provider’s secret. It can’t be left blank.
• Switching provider does not delete the credentials you saved for the previous provider — Kinde keeps the retired connection so that SMS messages already queued against it can still be delivered. The settings page only ever shows the fields for the provider that is currently selected.