Phone verification¶
Phone verification would prove that an account controls a phone number by sending it a one-time code over SMS.
Not supported on TEBHOS
TEBHOS has no SMS provider. The API generates phone codes but never delivers them to a phone, so no phone number can be verified and no account can use SMS as a second factor. Build account security on multi-factor authentication with TOTP, passkeys, and backup codes instead.
Detecting support¶
The instance discovery document at GET https://tebhos.com/api/v1/.well-known/tebhos carries a features.sms_enabled boolean. It is false on TEBHOS, and a client hides every phone entry point while it is false: adding a phone number and phone-based required actions. Guild verification levels never require a phone: the phone-based level was removed.
Related fields¶
| Field | Where | Value on TEBHOS |
|---|---|---|
has_verified_phone |
user object | Always false in practice, because no code can be delivered |
has_mfa |
sudo MFA methods object | Would count a verified phone, so in practice reflects TOTP and passkeys only |
Routes¶
The routes below exist for compatibility but cannot complete, because the code they wait for is never sent.
| Route | Behaviour |
|---|---|
POST /auth/2fa/sms/enroll |
Accepts phone_number in E.164 form (+ followed by 7-19 digits, first digit not 0) and returns phone_number_masked and ttl_seconds (300). No SMS is sent |
POST /auth/2fa/sms/resend |
Issues a new undelivered code for the pending number |
POST /auth/2fa/sms/verify |
Accepts a 6-digit code. Without a delivered code it can only fail |
POST /users/@me/phone/verify |
Accepts code (and an ignored phone) and returns {"verified": true} on success. Without a delivered code it can only fail |
POST /auth/login/mfa/sms/send |
Login step for accounts with a verified phone. No such account exists on TEBHOS |
POST /users/@me/phone/send-verification, POST /users/@me/phone/inbound-challenge, and the /users/@me/required-actions/phone-gate-escape routes are not implemented and return 404.