Sandbox
Available in
- Germany,
- Netherlands,
- UK
Number Verification 2.0 (CAMARA)
2.1.0-rc.1Image
It can be used for
- Reduced friction in registration journeys with faster and seamless authentication
- Preventing identity vulnerabilities and social engineering attacks by using secure OS-level token exchange
- Improving user experience with silent user verification that works over both wi-fi and mobile data connections
API Information
How it works
- Number Verification 2.0 integrates directly with the mobile operating system and the mobile network operator’s entitlement server to authenticate a user's phone number.
- When an app or service initiates verification, it triggers a TS.43-compliant validation of the device’s SIM, which is confirmed by the operator’s backend in exchange for a temporary token. This token is then used in a secure API call to validate or share the mobile number associated with the device.
- This method reduces friction, enhances security, and removes reliance on other methods of authentication, which can be unreliable or intercepted.
TS.43 Entitlement Server Integration
Before initiating the Number Verification API call, the solution integrates with the device operating system to capture user consent and authenticate via the TS.43 entitlement server. This operating system integration ensures a seamless experience for the end customer and offers the following additional benefits:
-
No need to rely on header enrichment which is fragmented across the world (http vs https).
-
Works over wi-fi and in the browser.
-
Consent pop up that is natively captured by the operating system.
-
User doesn’t have to enter the phone number.
End-to-End Sequence
The following diagram shows a high-level sequence based on the Google Android implementation:
Image
- Temporary Token Generation (Client-Side) - The mobile device initiates a request to the entitlement server using the TS.43 protocol. This request is authenticated via EAP-AKA, confirming the device is on the Vodafone network. A temporary token is issued to the device, which is then passed to the app backend.
- Token Exchange – The requesting app or service uses the temporary token as an authentication claim within a JWT bearer flow. Vodafone validates the token with the entitlement server and issues an operator access token.
- Number Verification API Call - The backend calls the CAMARA Number Verification API (/number-verification/v2) using the operator token. Vodafone compares the input phone number with the network-authenticated MSISDN and returns the result.
