What is SMS two-factor authentication (2FA) and why you should add it to your mobile app in 2021
Tags: Authentication, Sms, Mobile App Development, Sms Api, App Development

What is SMS two-factor authentication (2FA) and why you should add it to your mobile app in 2021 46elks Follow Dec 18, 2020 · 5 min read

App and data security have been a big issue for developers for a while now and it’s only getting more important. With millions of applications available online and millions more through the Apple and Google app marketplaces, the opportunity for individuals engaged in cybercrime is massive. If there was a time to add two-factor authentication (2FA) to your applications, it is now.

Two-factor authentication (2FA) is an essential first step to securing your mobile application and if you are not doing this in 2020, you need to start. Using the 46elks API to send one-time passwords to your users is a simple and effective way to increase the security of your IOS, Android and web-based applications. As a developer, it provides you with a smooth way to integrate improved security without needing operator connections or third party software. As a consumer, SMS 2FA is familiar and something we all have ready access to.

What is two-factor SMS authentication (2FA)?

SMS Two Factor Authentication (2FA) is a security verification procedure that allows a company to more safely identify their users. The company usually triggers the authentication process when users of their service are logging into their website, software, or mobile application. During the log-in process, the user provides their mobile number so they can receive a one-time password (OTP), token or other identifier and an SMS is sent to that number. When an OTP is time-limited it is known as TOTP and this type of password offers increased levels of security as it decreases the chance that brute force attacks are successful.

Once the user has received their OTP, they can then use this code to log into the service of the company. This process significantly reduces the ability for online data to be compromised as only the user with the linked phone number will be able to access the account at the time.

Flowchart of the technical process to authorise a user with an SMS one-time password

What are the benefits of SMS 2FA to your mobile app?

The primary reason we want to use 2FA is to confirm that the person requesting to use our service is that person in reality and not someone attempting to gain access to that person’s account. We need to match information a person may have with the information we have in our system. There are several types of information a person may have that we can use to identify them. Three common ways to view these different types of information:

Something the user knows (password, PIN, pattern, etc.) Something the user has (SIM card, one-time password generator, or hardware token) A biometric property of the user (fingerprint, retina, voice)

By sending an OTP to your users via SMS or a phone call you are verifying something the user has (well, has now been given 😊). If this is done in combination with a username and password, you have successfully implemented two-factor authentication.

Verifying with SMS provides a good customer experience

SMS and phone call authentication provide your users with an experience they are familiar with and most people have a phone within arms reach. Unique mobile phone usage in Europe was above 85% in 2020. If you are not sending SMS to your customers for authentication or anything else for the matter, you should be.

But aside from the fact that nearly everyone has a mobile phone, SMS is a technology that we are all familiar with, behaves similarly on all devices and doesn’t require any extra applications to be installed. Whilst the way you trigger sending SMS and Phone calls from IOS and Android might differ, the outcome will be identical. This ease of use and familiarity is making your customers lives easier and thus improving their experience with your products and services.

Flarie is a 46elks customer that has over 800,000 active users in their mobile gaming service. Given that users can win real prizes with Flarie, fraudulent accounts and scammers are a real financial concern. Flarie decided to use 46elks to send OTP SMS to their customers and found that not only did it decrease fraud but it also improved their user experience. Read more about Flarie here.

Automate SMS authentication integration with 46elks

Using the 46elks API to add OTP means you can implement authentication processes in the way your team wants them to. Here are the basic building blocks to adding SMS OTP authentication to your mobile app:

A 46elks account (Get one here) Create a database to record the expected OTPs and user information Create a trigger in your application that does two things:

Generate an OTP and add it to the database along with the appropriate user information (and time if necessary)

Sends an SMS to the customer with the same OTP using the 46elks API

import requests response = requests.post(

"https://api.46elks.com/a1/sms",

auth = ("u3498dfu93unf934", "dlgfkmfiouvber430834"),

data = {

"from": "AuthElk",

"to": "+46766861004",

"message": "Your one-time password is 28364"

})

4. Once the user has attempted to enter the password in your application you can assess this entry attempt against the expected OTP in your database

If it matches then you can allow entry

then you can allow entry If it does not match then you can offer reattempts or simply deny the service

These are the broad building blocks and depending on your application you may need to tweak this flow slightly to provide your users with a great experience and secure your applications.

Key Takeaways

Data and application security becoming increasingly important and adding SMS authentication improves your application’s resilience to attacks

Adding SMS OTP is familiar, simple and effective which means the experience your customers have is positively impacted. It is the small details of applications that make the biggest difference in many cases

Adding SMS authentication to your application is simple and straightforward with the 46elks SMS and Phone calls API

If you are looking for more ways to use SMS and phone calls make sure you check out our tutorials and guides on our website www.46elks.com/tutorials 🚀