How to Use Mobile Number Login in Fabrixly-IDS

Overview

Fabrixly-IDS allows users to log in with their mobile phone number instead of an email! Works with all auth modes (password, OTP, 2FA, flexible)!

Step 1: Configure Mobile Login for Your Client

First, enable mobile login for your OIDC client!

Admin Console Setup

1. Go to Fabrixly-IDS Admin Console → Clients
2. Select or create a client → click Edit
3. Under Authentication Settings:
   • Toggle Enable Mobile Login to On
   • Choose your Auth Mode (any mode works!)
   • Choose OTP Delivery Method (for OTP/2FA modes)
4. Save!

API Setup

Authenticating API Requests

Management API endpoints (like /api/clients, /api/users, etc.) require administrative authentication. To call them:

1. Include the Token in the Authorization Header: Add -H "Authorization: Bearer <your-admin-jwt-token>" to your API calls.

Obtain an Admin JWT Token:

curl -X POST https://ids.fabrixly.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@example.com",
    "password": "your-admin-password"
  }'

Note: This returns a JSON response containing a token.

curl -X POST https://ids.fabrixly.com/api/clients \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{
    "client_name": "Mobile Login App",
    "redirect_uris": ["http://localhost:3007/callback"],
    "response_types": ["code"],
    "grant_types": ["authorization_code"],
    "token_endpoint_auth_method": "client_secret_basic",
    "auth_mode": "otp",
    "enable_mobile_login": true,
    "otp_delivery_method": "sms"
  }'

Step 2: User Mobile Number Verification

Users must first verify their mobile number in Fabrixly-IDS before logging in with it!

How to Verify a User's Mobile Number

Admin Console:

1. Go to Users → select user → Edit
2. Enter mobile number → click Verify Number (sends OTP via SMS)
3. User enters OTP → number is verified!

API:

# Send verification OTP to user's mobile
curl -X POST https://ids.fabrixly.com/api/users/verify-mobile \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{ "mobile": "+1234567890" }'

# Verify the OTP
curl -X POST https://ids.fabrixly.com/api/users/confirm-mobile \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{ "otp": "123456" }'

Step 3: User Login Flow with Mobile Number

1. User visits your app → clicks "Login"
2. Redirected to Fabrixly-IDS login screen: choose to enter email or mobile number
3. User enters mobile number → proceeds with chosen auth mode (password, OTP, 2FA, etc.)
4. Logged in successfully!

Example Mobile Login Express App

Create mobile-login-app.js:

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');

const app = express();
const PORT = 3007;

app.use(session({
  secret: 'mobile-login-is-convenient',
  resave: false,
  saveUninitialized: true
}));

async function initClient() {
  const issuer = await Issuer.discover('https://ids.fabrixly.com/oidc');
  return new issuer.Client({
    client_id: 'your-mobile-login-client-id',
    client_secret: 'your-mobile-login-client-secret',
    redirect_uris: ['http://localhost:3007/callback']
  });
}

let client;
initClient().then(c => client = c);

app.get('/', (req, res) => {
  if (req.session.user) {
    res.redirect('/dashboard');
  } else {
    res.send(`
      <h1>Mobile Number Login Example</h1>
      <p>Login with your phone number!</p>
      <a href="/login">Login</a>
    `);
  }
});

app.get('/login', (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email phone',
    state: req.session.state,
    nonce: req.session.nonce
  });
  res.redirect(authUrl);
});

app.get('/callback', async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    'http://localhost:3007/callback',
    params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  req.session.tokenSet = tokenSet;
  req.session.user = await client.userinfo(tokenSet.access_token);
  res.redirect('/dashboard');
});

app.get('/dashboard', (req, res) => {
  if (!req.session.user) return res.redirect('/');
  
  res.send(`
    <h1>Welcome!</h1>
    <p>Email: ${req.session.user.email}</p>
    <p>Phone: ${req.session.user.phone_number}</p>
    <p>Logged in with mobile number! 📱</p>
    <a href="/">Home</a>
  `);
});

app.listen(PORT, () => console.log(`Mobile login app running on http://localhost:${PORT}`));

OTP Delivery via SMS for Mobile Users

If you set otp_delivery_method to "sms" or "both", OTPs are sent to user's verified mobile number!

Set up SMS Provider: Configure SMS provider in Fabrixly-IDS .env file:

SMS_PROVIDER=twilio  # or other providers like plivo, etc.
TWILIO_ACCOUNT_SID=your-twilio-sid
TWILIO_AUTH_TOKEN=your-twilio-token
TWILIO_PHONE_NUMBER=your-twilio-number

Why Use Mobile Login?

1. Convenience: Many users remember their phone number better than email
2. SMS OTP: Easily deliver OTPs directly to user's phone
3. Wider Reach: Some users prefer using mobile over email

Security Best Practices

1. Always verify mobile numbers before allowing login with them!
2. Use HTTPS!
3. Rate-limit login attempts and SMS OTP requests!

Troubleshooting

• "User doesn't have a verified mobile number" error: Ensure user has verified their number first!
• Can't enter mobile number in login form: Verify enable_mobile_login is true for your client!
• OTP not arriving via SMS: Check your SMS provider configuration!

Next Steps

• Use mobile login with 2FA mode for extra security
• Combine with social logins for maximum convenience!