authentication

Verify SMS OTP

Complete passwordless SMS authentication by verifying the one-time password. Returns a session if validation is successful.

post/signin/passwordless/sms/otp

Request body

phoneNumberstring required

Phone number of the user

otpstring required

One-time password received by SMS

Example request

{
  "phoneNumber": "+123456789"
}

Response

User successfully authenticated

Example response

{
  "session": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "accessTokenExpiresIn": 900,
    "refreshTokenId": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
    "refreshToken": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
    "user": {
      "avatarUrl": "https://myapp.com/avatars/user123.jpg",
      "createdAt": "2023-01-15T12:34:56Z",
      "defaultRole": "user",
      "displayName": "John Smith",
      "email": "john.smith@nhost.io",
      "emailVerified": true,
      "id": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
      "locale": "en",
      "metadata": {
        "firstName": "John",
        "lastName": "Smith"
      },
      "phoneNumber": "+12025550123",
      "roles": [
        "user",
        "customer"
      ]
    }
  },
  "mfa": {
    "ticket": "mfaTotp:abc123def456"
  }
}

Changes

Changed in 5 of the 15 revisions of this API.144

Jun 24, 20260fc5fd589dbf1See the full diff
- ●
  added the new otp-too-many-attempts enum value to the error response property for the response status default
  response-property-enum-value-added
Apr 20, 2026b39086c84b4311See the full diff
- ●
  added the new user-already-exists enum value to the error response property for the response status default
  response-property-enum-value-added
- ○
  removed the email-already-in-use enum value from the error response property for the response status default
  response-property-enum-value-removed
Jan 13, 20267560a2934be41See the full diff
- ▲
  the session/user/locale response property's maxLength was increased from 2 to 3 for the response status 200
  response-property-max-length-increased
Nov 11, 2025484d9f1a422a1See the full diff
- ●
  added the new provider-account-already-linked enum value to the error response property for the response status default
  response-property-enum-value-added
Oct 9, 20252bb5c4e4046313See the full diff
- ●
  added the new email-already-in-use enum value to the error response property for the response status default
  response-property-enum-value-added
- ○
  removed the otp-too-many-attempts enum value from the error response property for the response status default
  response-property-enum-value-removed
- ○
  removed the provider-account-already-linked enum value from the error response property for the response status default
  response-property-enum-value-removed
- ○
  removed the user-already-exists enum value from the error response property for the response status default
  response-property-enum-value-removed
This revision also has 20 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history