Silent Authentication

Silent Authentication uses a mobile phone's Subscriber Identity Module (SIM) to verify a user's identity, without any user input. It checks the user's phone number against their carrier's records to confirm that it is active and legitimate.

Once a request is verified, you can continuously authenticate the user until the request either expires or is canceled by the user.

Advantages

• Minimal user input - Silent Authentication is very user friendly; once the user has entered their credentials, the authentication process happens in the background. There are no OTP codes to input, making the process as frictionless as possible.
• No phishing - By moving authentication directly between the carrier and the mobile device, the threat of phishing via SMS is removed.

Requirements

• The user must own a mobile device - Silent Authentication needs the user to authenticate from a mobile device.
• A cellular network connection is required - Silent Authentication relies on a verified GSM response from the device to prove its credentials, which is not sent if the user is connected to Wi-Fi. The user must therefore trigger the authentication request using cellular data. You can use our mobile libraries to help force a mobile connection.

Bypass WiFi for Silent Authentication

Vonage provides two Libraries that you can use in your applications to help you make a HTTP request over a cellular network, even when on WiFi. These are available through GitHub:

• Android
• iOS

Click on each platform for more details, including installation instructions, compatibility information, and usage examples.

Implementation

Silent Authentication can work both synchronously and asynchronously (using webhooks).

Coverage Check

Verify Silent Authentication supports both synchronous and asynchronous coverage validation mechanisms. By default, the coverage_check parameter is set to true, which triggers a real-time network coverage lookup. If the destination network is unsupported, the API responds immediately with a synchronous error, allowing customers to fail fast and avoid unnecessary redirection.

Alternatively, customers may opt into an asynchronous flow by explicitly setting coverage_check=false in the Silent Authentication payload. In this mode, the API returns a check_url regardless of network support status. This URL is intended to be handed off to the client application and invoked during the initial redirection step. If the network is unsupported, the redirection will fail. For customers configured to receive callbacks, the failure reason will be delivered asynchronously via the specified callback endpoint. If callbacks are not implemented, the unsupported network condition will surface during the initial redirection attempt. For additional information, refer to the Verify API Reference.

Environments

Production

Using Verify in production requires the registration of your application using the Network Registry. Vonage’s Network Feature Registration service automates the registration process through a common dashboard interface and sends the information to the operators for approval.

Non-Production

Access to non-production environments depends on the country where Silent Authentication will be implemented:

Using Silent Authentication in Germany

When using the Silent Authentication in Germany, you must include specific wording in your application to gain the user's consent before any IP matching / processing:

English

German

Availability

Silent Authentication is currently available in the territories listed in the table.