MCP for auth in 5 minutes: phone verification through your AI agent

Raya — Thu, 03 Sep 2026 22:14:48 +0000

Most AI coding tutorials stop at "ask the agent to write code". This one is about giving the agent a tool it can call, an MCP server, so it can send and verify one-time codes while you're still building. I work at MyOTP.App and this uses our server, so read it with that in mind.

If you're on Claude Code, Claude Desktop, Cursor, Codex or anything else that speaks MCP, this takes about five minutes.

Why bother

When you ask an agent to "add phone verification" with no tool attached, it writes code against an SDK it half remembers. Sometimes that SDK doesn't exist in the version it picked. You find out at runtime.

With the MCP server attached, "send a code to my number" is a tool call. The agent sends a real message, you get a real SMS, and only then do you ask it to write the integration. The code comes after the proof.

Setup

There's nothing to install. npx fetches it on demand.

Get an API key at myotp.app/sign-up. New accounts get 15 trial credits, no card. Add your IP to the key's allowlist, or use * while you're developing locally.
Add the server to your client config. Claude Code:

claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp

Claude Desktop, in claude_desktop_config.json:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": { "MYOTP_API_KEY": "your-key" }
    }
  }
}

Restart the client. Ask it: "Send an OTP to +44 7700 900123 over SMS." Then: "Verify code 482917 for that number."

If your client can't launch local processes, point it at the hosted server instead: https://mcp.myotp.app/mcp, key in the X-API-Key header or as Authorization: Bearer. Add 108.61.176.199 to your key's IP allowlist for that, since hosted calls reach our API from that address and not from your machine.

What's in it

Ten tools. The four you'll use most:

generate_otp sends a code over SMS, WhatsApp or Telegram and returns a transaction id.
verify_otp checks what the user typed.
check_otp_status tells you whether the message was queued, sent, delivered or failed, which is where you look first when "the code never arrived".
extend_otp gives a slow user more time without sending a new code.

The rest cover the account: get_account_info, get_account_status, get_usage_report, and three that exist so an agent can run without a human in the loop. create_account registers a new account and returns a key, get_topup_quote and top_up_credits buy credits over HTTP 402 through Stripe, by card or USDC. An agent that runs out of credits can refill and carry on.

What it doesn't replace

The MCP server is a tool for the agent, not a dependency for your app. Your application still calls the REST API from the server side with the key in the X-API-Key header. The published examples for Next.js, Express, Flask, Django, Rails and Laravel are in the brntech/myotp-agentkit repo and are the copy-paste starting points.

The one thing that goes wrong

IP allowlisting. A key created from your laptop is allowlisted to your laptop's public IP. When the first call from a server or from the hosted MCP endpoint comes back with a 403 that says the IP isn't allowed, that's the cause, not the key.

Disclosure again: I work at MyOTP.App. If something here is wrong, say so in the comments and I'll fix the post.

Supabase phone auth without a built-in provider: the Send SMS Hook, step by step

Raya — Thu, 03 Sep 2026 22:14:44 +0000

Supabase ships phone auth with a short list of built-in SMS providers. If the one you want isn't on it, you're not stuck. There's a documented escape hatch called the Send SMS Hook, and it takes about three minutes to wire up. I work at MyOTP.App, so the walkthrough uses us, but the mechanism is the same for anyone who hosts a compatible endpoint.

What the hook is

Supabase doesn't send SMS. Phone login is auth logic, and the message has to leave through somebody's gateway. The provider dropdown is the built-in list. The Send SMS Hook replaces it: when a user requests a phone OTP, Supabase POSTs the code and the phone number to a URL you configure, and your endpoint delivers it however it likes.

Supabase keeps the code and does the verification. The hook is delivery only. Nothing changes in your client code.

Setup, in this order

The order matters. The endpoint URL is created from the secret, so the secret has to exist first.

In Supabase, open Authentication, then Hooks, then Send SMS Hook. Choose the HTTPS type and click Generate secret. Copy the value. It starts with v1,whsec_. Don't save the hook yet.
In your MyOTP dashboard, open Integrations, pick which application should pay for the messages, paste the secret, and create the integration. You get back a URL of the form https://api.myotp.app/v1/supabase/send-sms/<id>.
Back in Supabase, paste that URL into the hook, enable it, and save.

That's it. No SDK, no server code, nothing to deploy.

What Supabase sends

{
  "user": { "id": "8484b834-...", "phone": "919000000001" },
  "sms": { "otp": "123456" }
}

Requests are signed with the Standard Webhooks scheme: webhook-id, webhook-timestamp and webhook-signature headers, verified against the secret with the v1,whsec_ prefix stripped and the rest base64-decoded. If you write your own endpoint, don't skip this. An unauthenticated send-me-an-SMS URL on the public internet has a short and expensive life.

Two things that trip people up

Supabase wants an empty body with a 200. Return a friendly JSON receipt and Supabase may treat the call as failed, so the user sees an error while the SMS is already on its way.

Test with a phone in your hand. Hook failures, provider failures and route failures all look identical from the Supabase side.

Channels

Supabase hands over a code and a phone number and has no opinion about how the code reaches the person. The same hook can deliver over WhatsApp or Telegram instead of SMS. On our side that's a per-application setting. The Supabase side doesn't change.

When not to bother

If your current provider works and your users are all in one country where it delivers well, leave it alone. The hook earns its keep when delivery is patchy in the countries you care about, when per-verification fees stack on top of message cost, or when you want WhatsApp and Telegram without rebuilding auth.

Disclosure again: I work at MyOTP.App. The docs page for this integration is myotp.app/integrations/supabase and it links to Supabase's own hook documentation.

DEV Community: Raya