Authentication use case — verify a user with a phone call

This guide explains how Kasookoo SDK Silent Authentication lets your app confirm that a user really owns a phone number — without sending an SMS code.

It is written for product owners, business stakeholders, and anyone who wants to understand the user experience before reading the technical integration guides.

For developers: see Authentication Dev (integration) and Authentication API Reference (API reference).

---

Table of contents

1. What problem does this solve?
2. Who is involved?
3. How verification works (in plain terms)
4. Five ways to verify a user
5. Option 1 — PSTN Call-back
6. Option 2 — WhatsApp Call-back
7. Option 3 — Flashcall
8. Option 4 — Enhance OTP Call
9. Option 5 — InApp
10. Which option should I choose?
11. What the user needs
12. Safety and privacy
13. Next steps

---

What problem does this solve?

Many apps verify users by sending a text message (SMS) with a one-time code. That works, but SMS can be slow, expensive, or unreliable in some markets.

Silent Authentication Call uses a phone call instead. The user proves they own the number by taking a simple call-related action — often without typing anything at all.

---

Who is involved?

The user never talks to Kasookoo SDK directly — they only interact with your app and their normal phone or WhatsApp app.

---

How verification works

Every option follows the same big picture:

1. The user opens your app and starts sign-in or sign-up.
2. Your app asks Kasookoo SDK to start a short-lived verification session for that phone number.
3. Something happens on the phone — a call is made, received, or a code is shown.
4. Kasookoo SDK checks that the action matches the expected number and session.
5. Your app is told success or failure, and the user can continue or try again.

flowchart LR
    User[End user]
    App[Your app]
    K[Kasookoo SDK]
    Phone[Phone or WhatsApp]

    User -->|Opens app, enters number| App
    App -->|Start verification| K
    User <-->|Call or code| Phone
    Phone <-->|Network signal| K
    K -->|Verified or failed| App
    App -->|Let user in| User

Sessions are short (about one minute by default). If the user waits too long, they start again.

---

Five ways to verify a user

Kasookoo SDK supports five methods. Your product team picks one (or offers a fallback) per market or user preference.

---

Option 1 — PSTN Call-back

Idea: The user calls a Kasookoo SDK phone number from their normal mobile dialler (the same app they use for everyday calls). Kasookoo SDK sees which number is calling, matches it to the number they entered in your app, and confirms them. The call is ended quickly — they do not need to speak to anyone.

sequenceDiagram
    participant User
    participant App as Your app
    participant K as Kasookoo SDK
    participant Mobile as User's phone (dialler)

    User->>App: Tries to log in
    App->>K: Start verification
    K-->>App: "Please call this number: …"
    App->>User: Shows number to dial
    User->>Mobile: Opens phone app and dials
    Mobile->>K: Incoming call from user's number
    K->>K: Number matches — verified
    K-->>App: Success
    App->>User: Welcome in

Step by step:

1. The user tries to log in or sign up in your app.
2. Your app starts verification and shows a phone number to call.
3. The user switches to their mobile phone app (not WhatsApp, not a call inside your app) and dials that number.
4. Kasookoo SDK recognises the caller’s number and marks the user as verified.
5. Your app receives confirmation and lets the user in.

Important: This must be a real mobile network call from the handset. Calling from a computer, tablet-only device, or an in-app internet phone line is not supported for this option.

---

Option 2 — WhatsApp Call-back

Idea: Same as Option 1, but the user places a WhatsApp voice call to a Kasookoo SDK WhatsApp number instead of using the mobile dialler.

sequenceDiagram
    participant User
    participant App as Your app
    participant K as Kasookoo SDK
    participant WA as WhatsApp on user's phone

    User->>App: Tries to log in
    App->>K: Start WhatsApp verification
    K-->>App: "Call this WhatsApp number: …"
    App->>User: Shows WhatsApp number
    User->>WA: Voice call to Kasookoo SDK
    WA->>K: Incoming WhatsApp call
    K->>K: WhatsApp identity matches — verified
    K-->>App: Success
    App->>User: Welcome in

Step by step:

1. The user starts login in your app.
2. Your app shows a WhatsApp number to call (voice call, not a chat message).
3. The user opens WhatsApp on their phone and starts a voice call to that number.
4. Kasookoo SDK matches the WhatsApp account to the phone number on file and verifies the user.
5. Your app is notified and continues.

Important: WhatsApp must be on the user’s mobile phone. WhatsApp Web or desktop alone is not enough.

---

Option 3 — Flashcall

Idea: Kasookoo SDK calls the user and hangs up after a few seconds. The user sees a missed call from a known Kasookoo SDK number. Your app detects that missed call on the same device and completes verification — the user does not dial anything and does not answer the call.

sequenceDiagram
    participant User
    participant App as Your app
    participant K as Kasookoo SDK
    participant Phone as User's phone

    User->>App: Tries to log in
    App->>K: Start Flashcall verification
    K->>Phone: Brief ring (~3 seconds)
    K->>Phone: Hang up (missed call)
    Phone-->>App: Missed call detected
    App->>K: Confirm same device + session
    K-->>App: Success
    App->>User: Welcome in

Step by step:

1. The user starts login in your app on their phone.
2. Kasookoo SDK places a short outbound call to their number.
3. The phone rings briefly, then the call ends — the user sees a missed call.
4. Your app (with Kasookoo SDK’s help) checks that the missed call came from the expected number on the same device.
5. Verification succeeds and the user continues.

Important: The user must use the same phone where they installed your app. Verification ties the session to that device.

---

Option 4 — Enhance OTP Call

Idea: Kasookoo SDK calls the user. When they answer, an automated voice reads a short code. The same code also appears on screen in your app. The user agrees to listen and see the code, then taps a single Verify button — they do not type the digits manually.

sequenceDiagram
    participant User
    participant App as Your app
    participant K as Kasookoo SDK
    participant Phone as User's phone

    User->>App: Tries to log in
    App->>K: Start Enhance OTP Call verification
    K->>Phone: Outbound call
    K-->>App: Send code to app (notification)
    User->>Phone: Answers call
    Phone->>User: Automated voice reads code
    App->>User: Shows code + consent screen
    User->>App: Taps Verify
    App->>K: Confirm code
    K-->>App: Success
    App->>User: Welcome in

Step by step:

1. The user starts login in your app.
2. Kasookoo SDK calls their phone and sends the same code to your app.
3. If they answer, they hear the code spoken aloud.
4. Your app shows a consent screen with the code visible and one Verify button.
5. The user taps Verify; Kasookoo SDK checks the code and confirms them.

Use when: PSTN or WhatsApp Call-back (Options 1–2) is difficult, but a short outbound call is acceptable.

---

Option 5 — InApp

Idea: No phone call at all. Kasookoo SDK sends a verification code directly to your app via push notification. The user sees the code on screen, agrees, and taps Verify once. They do not type the code.

sequenceDiagram
    participant User
    participant App as Your app
    participant K as Kasookoo SDK

    User->>App: Tries to log in
    App->>K: Start InApp verification
    K-->>App: Push notification with code
    App->>User: Shows code + consent screen
    User->>App: Taps Verify
    App->>K: Confirm code + device
    K-->>App: Success
    App->>User: Welcome in

Step by step:

1. The user starts login in your app on their phone.
2. Kasookoo SDK sends a verification code to the app (push notification).
3. Your app shows the code and a Verify button.
4. The user taps Verify.
5. Kasookoo SDK confirms the code and device, then your app continues.

Use when: You want the simplest UX and push notifications are already enabled in your app.

---

Which option should I choose?

You can offer one primary method and fall back to another (for example: try Flashcall first, then Enhance OTP Call).

---

What the user needs

All options assume the user enters (or already has) the correct phone number in your app before verification starts.

---

Safety and privacy

• Verification sessions expire quickly (about one minute) to reduce abuse.
• Kasookoo SDK limits how often the same number can start verification in a short window.
• For Flashcall and InApp flows, verification is tied to the same device that started the session.
• Secret codes are never shown in public APIs; they travel only between Kasookoo SDK and your app.
• Your app should only let the user in after Kasookoo SDK reports verified.

---

---

Kasookoo Communications Ltd · Kasookoo SDK Backend