Skip to content

SMS codes via Telnyx Verify (carriers block our long code) - #275

Merged
ralyodio merged 1 commit into
masterfrom
fix/sms-telnyx-verify
Oct 6, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/sms-telnyx-verify

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Problem: login codes sent as a plain SMS from +14084269127 reach Telnyx numbers, but real phones never get them. AT&T rejected Anthony's with error 40010 (not 10DLC registered).

Fix:

  • When TELNYX_VERIFY_PROFILE_ID is set, the send-SMS hook sends GoTrue's own code through Telnyx Verify (custom_code), which uses Telnyx's registered senders.
  • The plain-message path stays only as a fallback for when no Verify profile is configured.

Setup and checks:

  • A Verify profile QryptChat (US/CA, 6 digits) is created.
  • Its ID is in app.env and the vault.
  • A direct test reached an AT&T phone: delivered at 07:41 UTC.
  • 614 tests pass.

🤖 Generated with Claude Code

A plain SMS from +14084269127 reaches a Telnyx number but AT&T refuses it
(40010, not 10DLC registered), so real users got nothing. The send-sms hook
now sends GoTrue's code through Telnyx Verify (custom_code) from Telnyx's
registered senders when TELNYX_VERIFY_PROFILE_ID is set; the plain message
stays only as a fallback. Verified to an AT&T phone 2026-10-06 07:41.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

13 finding(s)

MEDIUM: 9 | LOW: 4

Severity Rule Location
MEDIUM redos-nested-quantifier src/app/api/profile/update/route.js:73
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:38
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.jsx:66
MEDIUM js-unescaped-html-sink src/app/faq/page.jsx:57
MEDIUM js-unescaped-html-sink src/app/layout.jsx:137
MEDIUM js-unescaped-html-sink src/app/layout.jsx:141
MEDIUM js-unescaped-html-sink src/app/page.jsx:47
MEDIUM redos-nested-quantifier src/lib/auth/dns-name.js:88
MEDIUM js-unescaped-html-sink src/lib/components/chat/MessageItem.jsx:63
LOW secret-generic-credential src/app/api/auth/register-anon/route.test.js:32
LOW secret-jwt tests/debug-sms.js:10
LOW secret-generic-credential tests/private-key-import-export.test.js:252
LOW secret-generic-credential tests/private-key-import-export.test.js:264

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 8926ffd into master Oct 6, 2026
11 checks passed
ralyodio added a commit that referenced this pull request Oct 6, 2026
Pressing Send Code again inside Supabase's 60s resend window showed
"Failed to send verification code. Please try again later.", which read as
SMS being broken again. It now answers 429 "A code was just sent. Please
wait N seconds..." with Retry-After. Also ships #275 (codes via Telnyx
Verify, since carriers refuse our long code with 40010).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant