Interaction flows for Phone Number Verification Service-Phone Number Verification Service(PNVS)-阿里云帮助中心

Integrating the Phone Number Verification Service involves both your client and server. The process differs slightly for each authentication method. This topic describes the complete interaction flows for CAPTCHA, Phone Number Authentication, and Fusion Authentication.

Note

Because an H5 page is less secure, a token is required for identity verification. The Phone Number Verification Service provides dedicated API operations for H5 page integration, a process that differs from integration with other clients. For more information, see H5 page demo experience.

CAPTCHA flow

The flow involves four parties: the developer client, the developer server, the Alibaba Cloud CAPTCHA server, and the Alibaba Cloud SMS server.

CAPTCHA flow (two-step verification)
1. First verification (client-side):
  1. The developer client initializes the SDK.
  2. The client sends a load request to the Alibaba Cloud CAPTCHA server to initialize verification.
  3. The server returns CAPTCHA resources, such as a slider or a puzzle.
  4. The user solves the CAPTCHA on the client.
  5. After the user solves the CAPTCHA, the Alibaba Cloud server returns a token.
2. Second verification (server-side):
  1. The client passes the token to the developer server to initiate the second verification.
  2. The developer server signs the parameters and sends a verification request to the Alibaba Cloud CAPTCHA server.
  3. The Alibaba Cloud server returns the second verification result.
  4. If the verification succeeds, the flow ends.
Subsequent process (using an SMS verification code as an example)
1. The developer server calls the Alibaba Cloud SMS server's API to send an SMS verification code.
2. The server returns the result of the request.

Note

Two-step verification mechanism: Client-side verification (user interaction) and server-side verification (token validation) to prevent attackers from bypassing the user interface.
After successful verification, the client obtains a token and passes it to the server for a second validation to ensure the result is trusted.
Security isolation: Sensitive operations, such as sending an SMS, are performed only on the server. CAPTCHA acts as a preliminary security layer.

Phone number authentication

One-click login

The one-click login interaction flow has four main steps: initializing the SDK, displaying the authorization page, granting authorization to log in, and retrieving the phone number on the server. 一键登录交互图

Initialization.
1. The user visits the app page.
2. The app initializes the SDK.
Display the authorization page.
1. After initialization succeeds, your app calls getLoginToken to display the authorization page.
2. The SDK requests the masked number.
3. If the request is successful, the authorization page displays the masked number and the carrier's agreement for the user to confirm.
  Important
  - The one-click login or registration feature requires explicit user authorization. The text on the login button must include 'Log In', and the text on the registration button must include 'Register'. You must not mislead users into granting authorization. Developers are prohibited from bypassing or simulating this step through any technical means. Otherwise, we reserve the right to suspend the service and pursue legal action.
  - For live applications that have integrated the mobile authentication SDK, Alibaba Cloud reviews the authorization page. If the authorization page is not displayed or designed as required, Alibaba Cloud will suspend the one-click login or registration service for the application.
  - To reduce the authorization page's loading time, you can determine in advance whether the user needs to log in or register. If so, you can call the pre-fetch API. This caches the necessary information on the client for later use.
  - Monitor the frequency of pre-fetch calls, which are free of charge. If the ratio of pre-fetch calls to actual phone number retrievals is abnormal, Alibaba Cloud will suspend the corresponding service.
Grant authorization and log in.
1. The user confirms the content on the authorization page and agrees to the relevant agreements.
2. The user clicks the Log In or Register button on the authorization page, and the SDK requests the token for phone number retrieval.
3. After the SDK successfully obtains the token, it returns the token to your app.
Retrieve the phone number on the server.
1. Your app passes the phone number retrieval token to your server.
2. Your server calls the GetMobile API of the Phone Number Authentication server with the token.
3. The Phone Number Authentication server retrieves the phone number and returns it to the developer server.
  Important
  Due to carrier restrictions, the client cannot obtain the phone number or the masked number.

Mobile number verification

The mobile number verification interaction flow has three main steps: initialization, obtaining authentication parameters, and initiating authentication.

Initialization.
1. The user visits the app page.
2. Your app initializes the SDK.
  Important
  On Android, if the user grants permission to read SIM card data, the initialization method also returns the phone number read from the SIM card. This helps pre-fill the phone number for the user. If permission is not granted or for other reasons, the method only returns whether Phone Number Authentication is supported. iOS does not support reading the phone number from the SIM card for pre-filling.
Obtain authentication parameters.
1. The user enters the phone number to be verified.
2. Your app obtains the mobile number verification token.
Initiate authentication.
1. Your app sends an authentication request to your server.
2. Your server calls the VerifyMobile API to get the authentication result. This result indicates whether the phone number entered by the user matches the phone number of the device's current network connection.
3. Your server returns the verification result to your client.

Fusion authentication

Integrate the Alibaba Cloud SDK into your client, then initialize and call the SDK.
From your server, call the Alibaba Cloud API GetFusionAuthToken to obtain an authentication token. Then, send this token to your client, which passes it to the SDK for authentication.
Display the scenario authorization page. Some scenarios require user authorization, such as agreeing to a privacy policy and obtaining an SMS verification code.
After the user grants authorization, your client obtains the exchange token from the SDK callback.
Your client uploads the exchange token to your server. Your server then calls the server-side API VerifyWithFusionAuthToken to exchange the token for the user's phone number.