.token_login

**Token login**: Instructions and schema for Login by SMS

When creating or updating a user, sending a truthy value for the field token_login enables Login by SMS for this user. This action resets the user’s password to an unknown string and generates a complex 64-character token, used to generate a token-login URL. The URL is sent to the user’s phone number by SMS, along with another (configurable) SMS that can contain additional information. Accessing this link before its expiration time logs the user in directly - without the need of any other credentials. The link can only be accessed once, and the token becomes invalid after one login. The token expires in 24 hours, after which logging in is only possible by either generating a new token, or disabling token_login and manually setting a password.

The SMS messages are stored in a doc of type login_token. These docs cannot be viewed as reports from the webapp, and can only be edited by admins, but their messages are visible in the Admin Message Queue page.

To disable login by SMS for a user, update the user sending token_login with a false value. To regenerate the token, update the user sending token_login with a true value.

See Also: Logging into CHT Apps

Configuration

Login via SMS settings are defined under the token_login key, as an object supporting the following properties:

app_settings.json .token_login

Code sample

The definition takes the typical form below:

"app_url": "https://example.org",
"token_login": {
  "enabled": true,
  "translation_key": "sms.token.login.help"
}

Related Content