Skip to main content
When your product talks to users over messages — an iMessage, SMS, or WhatsApp agent — there’s no browser to run the email OAuth redirect. Phone authentication flips the flow: you identify the user by their number, mint them a scoped token, and they prove the number is theirs with a one-time code before any money moves. It’s the pattern Agentcard’s own iMessage relay uses — and it runs entirely over MCP.

​
How it goes

Connect to the MCP server with your org client credentials; everything below is a tool call.
  1. First contact — create a cardholder for the number. Ask the user for their legal name and date of birth in conversation (cards are issued in their own name, and identity verification needs both):
  1. Mint the user’s token:
Returns the buyToken plus agentcardUserId and expiresAt. The token lasts 30 days, is scoped to that one user inside your org, and can be re-minted any time — store it keyed by the phone number and reuse it.
  1. Connect as the user with it. The buy token is itself an MCP credential: point a session at the same server with it and you get the full consumer toolset as that user.
Drive the conversational buy tool with the user’s messages and text its replies back. Cart, confirmation, card minting, and checkout all happen inside the tool.
  1. The user proves the number. Before their balance can be funded, the agent texts a 6-digit one-time code and the user reads it back in the conversation. You build none of this — the agent runs the verification itself and continues once it passes.

​
The code, precisely

KYC and a funded balance still gate real money — the agent hands the user secure links for both when they’re needed.

​
Email or phone?