Your customers are constantly on their phones. Your message should be too.
SMS Authentication & Verification
Add professional SMS-based 2FA to your login flow in under an hour. Two simple API calls — one to send the code, one to verify it. Works with PHP, Node.js, Python and any language that can make an HTTP request.
Add-on: $65/month · Standard SMS rates apply per verification
Passwords alone are no longer enough
Data breaches are a daily reality. When a customer's password is compromised — through phishing, reuse on another site, or a database leak — a stolen password is all a fraudster needs to access your system. Two-factor authentication (2FA) stops them in their tracks.
Even if someone has the right password, they cannot log in without also having access to the registered mobile phone. SMS 2FA is the most widely understood and adopted second factor — no app to install, no hardware token to carry. Just a text message with a six-digit code.
Australian businesses handling customer data, financial information, health records or personal details are increasingly expected — and in many industries required — to use multi-factor authentication. SMS 2FA is the lowest-friction way to meet that obligation.
How Easy SMS 2FA works
No webhooks. No callbacks. No complexity. Your server makes two simple HTTPS requests — the rest is handled for you.
User logs in normally
Your user enters their username and password. Your server verifies the credentials as usual.
You call /2fa/send
Pass their mobile number to our API. We generate a random 6-digit code, send it by SMS, and return a sessionId. Store it in your session for 5 minutes.
User enters the code
Your login form shows a code entry field. When submitted, you call /2fa/verify with the sessionId and the code. We respond with success: true or false. Done.
API Reference — Quick Look
Ready-to-use code examples
Copy the example for your language, replace YOUR_API_KEY, and you're ready to test. Each example includes both API calls and a complete login flow skeleton.
<?php
// ─────────────────────────────────────────────────────────────────
// MessageWorks Easy SMS 2FA — PHP Integration Example
// ─────────────────────────────────────────────────────────────────
// Prerequisites: PHP 7.4+, cURL enabled
// Replace YOUR_API_KEY with the key from your MessageWorks account.
// ─────────────────────────────────────────────────────────────────
define('MW_API_KEY', 'YOUR_API_KEY');
define('MW_API_BASE', 'https://api.messageworks.com.au/v1');
// ── STEP 1: Send the 2FA code ─────────────────────────────────────
// Call this when the user submits their login form.
// Returns a sessionId you must store (session, DB, cache) for 5 min.
function mw2fa_send(string $mobile): array {
$resp = mw_post('/2fa/send', ['mobile' => $mobile]);
// Returns: { "sessionId": "abc123", "expiresIn": 300 }
return $resp;
}
// ── STEP 2: Verify the code ───────────────────────────────────────
// Call this when the user submits the 6-digit code they received.
// Returns { "success": true } on match, { "success": false } if wrong/expired.
function mw2fa_verify(string $sessionId, string $code): bool {
$resp = mw_post('/2fa/verify', [
'sessionId' => $sessionId,
'code' => $code,
]);
return $resp['success'] ?? false;
}
// ── Internal helper ───────────────────────────────────────────────
function mw_post(string $path, array $body): array {
$ch = curl_init(MW_API_BASE . $path);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($body),
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-API-Key: ' . MW_API_KEY,
],
]);
$result = curl_exec($ch);
curl_close($ch);
return json_decode($result, true) ?? [];
}
// ─────────────────────────────────────────────────────────────────
// Example: login form handler
// ─────────────────────────────────────────────────────────────────
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Stage 1 — user submitted username + password
if (isset($_POST['username'])) {
$user = your_check_credentials($_POST['username'], $_POST['password']);
if ($user) {
$result = mw2fa_send($user['mobile']);
$_SESSION['2fa_session_id'] = $result['sessionId'];
$_SESSION['2fa_user_id'] = $user['id'];
// Redirect to your 2FA code-entry form
header('Location: /verify-2fa.php');
}
}
// Stage 2 — user submitted the 6-digit code
if (isset($_POST['code'])) {
$ok = mw2fa_verify($_SESSION['2fa_session_id'], $_POST['code']);
if ($ok) {
$_SESSION['user_id'] = $_SESSION['2fa_user_id'];
unset($_SESSION['2fa_session_id'], $_SESSION['2fa_user_id']);
header('Location: /dashboard.php'); // ✓ fully logged in
} else {
$error = 'Incorrect or expired code. Please try again.';
}
}
}
?>Everything included
No hidden fees. No extra contracts. Just add it to your existing MessageWorks account.