Setting Up Text-Message (SMS) Codes for Two-Factor Authentication
To send two-factor codes by text message, Yurbi needs an SMS provider. You can connect Twilio directly or use any other SMS gateway that offers an HTTP API. Messages are sent from your account with that provider; Yurbi does not include messaging credit.
If you do not want to set up a provider, leave the Text message (SMS) switch off under Allowed methods and offer the authenticator app and email methods instead.
Before you begin
An account with your SMS provider, able to send to your users' countries.
For Twilio: the Account SID, Auth token, and a From number or messaging service.
For other providers: the API documentation showing the endpoint, authentication header, and request body for sending a message.
Your server must be able to reach the provider's API over HTTPS.
Connecting Twilio
Go to Settings → Server Settings → Security Settings and scroll to Two-Factor Authentication.
Switch on Text message (SMS) under Allowed methods. The Text message provider box appears.
Choose Twilio and enter the Account SID, Auth token, and From number (in international format, for example
+15551234567).Click the page's Save button.
Enter your own mobile number next to Send test SMS and click it. The test uses the saved settings, so save first. You should receive a message within a few seconds.
Connecting another provider (Generic HTTP API)
In the Text message provider box, choose Generic HTTP API.
Fill in the request from your provider's documentation:
Field | What to enter | Example |
|---|---|---|
Endpoint URL | The send-message address |
|
HTTP method | Usually POST |
|
Auth header | The full header, as |
|
Body template | The request body, with |
|
From / sender id | The number or name your provider sends from |
|
Success match | Text that appears in a successful response; leave blank to accept any 2xx response |
|
Click the page's Save button, then use Send test SMS.
A body template that is valid JSON is sent as application/json; anything else is sent form-encoded. The template is sent as-is apart from the placeholders.
Security of your credentials
Credentials are stored encrypted on your server. After saving, the Auth token and Auth header show as ********. Leaving the masked value in place and saving keeps the existing secret; type a new value to replace it.
Phone numbers
Users enter their own mobile number when they enroll in the text-message method, from My Profile → Two-factor authentication. Numbers should be in international format with the country code. Administrators can see and edit the number in the user editor.
Troubleshooting
Send test fails. The error shown is the provider's response. Common causes: wrong credentials, the From number is not enabled for SMS, the destination country is not enabled on your account, or the server cannot reach the provider (firewall or proxy).
Test works but users do not get codes. Check the user's number in the user editor, including the country code. Check the provider's logs for delivery status; carrier filtering of short automated messages is common in some countries.
Codes arrive late. Codes expire after 10 minutes. If delivery regularly takes longer, ask users to use the authenticator app method instead.
I changed providers. Save the new provider settings; existing user enrollments keep working because only the delivery method changes.
Frequently asked questions
Can different groups use different providers or numbers? No. One provider is used for the whole server.
Does Yurbi send any other text messages? No. Only two-factor codes are sent, and only to users who chose the text-message method.
Which providers have been tested? Twilio directly. The Generic HTTP option has been used with regional gateways that accept a JSON POST with a bearer or basic authorization header.