---
title: auth-phone
description: Add phone OTP and phone-password authentication.
---

`auth-phone` provides phone-number login while keeping users and sessions in
`auth`. It depends on both `auth` and `auth-password`.

```sh
lenso module install auth
lenso module install auth-password
lenso module install auth-phone
cargo run --bin migrate
lenso serve
```

It contributes four routes:

- `POST /v1/auth/phone/otp/start`
- `POST /v1/auth/phone/otp/verify`
- `POST /v1/auth/phone/password/set`
- `POST /v1/auth/phone/password/login`

OTP length, expiry, resend cooldown, attempt limits, and per-IP start limits are
editable under the `auth-phone.otp` runtime config group. Outside local
development, provide the OTP secret through module-local Host config:

```sh
LENSO_MODULE_AUTH_PHONE__OTP_SECRET=<secret>
```

Without that secret, OTP start and verification fail closed outside local
development. Delivering the generated code through SMS remains the installing
application's responsibility.