Phone sign-in (OTP)
Sign in with a phone number and a 6-digit SMS code. Opt-in, in two screens, with what the CLI automates and what stays manual.
The user types their number, gets a 6-digit SMS code and, once confirmed, enters the app through the normal sign-in flow. There are two screens: /signinWithPhone (country and number) and /signinWithPhone/code (the code). The Continue with phone button shows on Sign in and Sign up when the withPhoneSignIn flag is on.
Phone sign-in is off by default. Quick mode does not include it. You turn it on in Advanced mode (tick Phone) or later, in an existing project, with kasy phone. On the REST API backend it does not exist: the button never shows.
What ships ready
- Country picker with flags, search and names in Portuguese, English and Spanish, defaulting to the device region.
- Real per-country mask and validation (length and numbering plan), so the button only enables with a valid number.
- Code screen with resend after 30 seconds and a way to change the number.
- If the person was a guest, the phone is linked to the current account.
- Both screens show up in the Storyboard with arrows Sign in, Sign up, Phone, Code and Home.
Implementation
New project
Run kasy new in Advanced mode and, in the sign-in providers list, tick Phone. The command turns the button on and already enables the Phone provider on the backend (Firebase or Supabase). On Supabase, only the SMS provider is left to connect.
Existing project
kasy phoneOr ask the assistant "turn on phone sign-in in my project" (the setup_phone_login tool of the MCP). The command turns the button on and enables the provider on the backend, where an API exists:
| Backend | What the command does | What stays manual |
|---|---|---|
| Firebase | Turns the button on and enables the Phone provider in Firebase Auth | Nothing required. Optional: test numbers |
| Supabase | Turns the button on and enables the Phone provider in Supabase Auth | Connect an SMS provider (Twilio, MessageBird, Vonage...) with a paid account |
| REST API | Nothing. Not supported | Implement it on your server |
Project created with a version before kasy-cli 1.85? Run kasy update core first: it brings the screens, the second route and the dependencies, and keeps the button off until you run kasy phone. kasy phone warns you if that is missing.
Check what is missing
kasy phone --checkShows what is ready and what is missing (authentication module, button, backend provider and, on Supabase, the SMS provider). The assistant does the same with setup_phone_login.
Test without spending SMS
- Firebase: under Authentication, Sign-in method, Phone, add test numbers with a fixed code.
- Supabase: in the Phone provider, use the test numbers list with a fixed code.
Then: Sign in, Continue with phone, number, code, Home.
Hide the button
kasy phone --offThe provider stays enabled on the backend. Run kasy phone again to bring it back.
Information
Automated or manual
- Automated: the
withPhoneSignInflag, the button on Sign in and Sign up, both screens, enabling the provider on Firebase and Supabase, the Android SHA-1 (already registered by the CLI). - Manual: the Supabase SMS provider (needs a paid account with the provider), and on iOS setting up push (APNs) for silent verification. Without APNs Firebase falls back to reCAPTCHA.
- Web with Firebase: Firebase uses reCAPTCHA for verification. That web flow has not been validated live yet; test it before offering it to customers.
Costs
Every code is an SMS billed by the provider. Firebase has a limited free quota and charges per SMS above it (check the current pricing table). On Supabase the cost is whatever the provider you connect charges.
If the button does not show
Run kasy phone --check. Common causes: withPhoneSignIn off, the authentication module off, or the REST API backend.
Last updated on 11/03/2026