Account Verification with Authy, Python and Flask

Ready to add Authy user account verification to your Flask application? Don't worry, this will be the easiest thing you do all day.

Here's how it all works at a high level:

1. A user begins the registration process by entering their information (including a phone number) into a signup form.
2. The authentication system sends a one-time password to the user's mobile phone to verify the phone number.
3. The user enters that one-time password into a form to complete registration.
4. The user sees a success page and receives an SMS alerting them that their account has been created!

Building Blocks

To get this done, you'll be working with the following Twilio-powered APIs:

Authy REST API

• Authy Docs: Find quickstarts, documentation, and info on the helper libraries.

Twilio REST API

• Messages Resource: We will use Twilio directly to send our users a confirmation message after they creates their accounts.

All of this can be done in under a half an hour with the simplicity and power of Authy and Twilio. Let's get started!

Application configuration

For this application we'll be using the The Twilio Python Helper Library and the Python Client for Authy API. We require some configuration from your side before we can begin.

Edit the DevelopmentConfig class constant values located in the account_verification_flask/config.py file:

AUTHY_KEY = 'your_authy_key'

TWILIO_ACCOUNT_SID = 'your_twilio_account_sid'
TWILIO_AUTH_TOKEN = 'your_twilio_auth_token'
TWILIO_NUMBER = 'your_twilio_phone_number'

SQLALCHEMY_DATABASE_URI = 'sqlite://'

Note that you have to replace the placeholders your_twilio_account_sid, your_twilio_auth_token, your_twilio_phone_number and your_authy_key with your information. You can find all of those parameters (and more) in your Twilio Account Console and your Authy dashboard.

Now that we've got the setup boilerplate out of the way, let's take a look at the User model.

The User Model

The User Model for this tutorial is pretty straight-forward. Note the new variable authy_user_id, which is implemented for storing the user's Authy identification token.

We'll be using the Flask-Login library for our user session management. To integrate this library into our code we need to implement a few properties and methods, then we're good to go.

Pretty simple User model, right? Next we're going to visit the registration form on the client side.

Registration Form

In order to validate the user's account and register the user, we need a mobile number with a country code. We can then use Authy to send a verification code via SMS.

In this example we're validating and rendering the forms with the WTForms library. This allows us to define the forms as classes inside Python.

That's it for the client side. Now let's look at what happens when the user submits the form.

Registration Server Side Implementation

Next our controller stores the new user, registers them with Authy's API, and requests a new verification code.

Next we'll set up our application to complete our user verification.

Verifying a User in Python

On the server we first check that the email belongs to a user that we haven't yet verified.

The process then has two critical steps:

1. Communicate with Authy's API to check if the given code is correct.

2. Send a confirmation SMS to the user using Twilio's API.

After that (assuming a success!) we redirect the user to a success page.

What happens if the message was never sent, didn't arrive, or can't be found? Let's look at how to handle those scenarios next.

Re-sending a Verification Code

The form for re-sending the code is a single line, so let's skip that detail for this tutorial. Instead, let's just take a look at the controller function for resending verifications.

This controller loads the User associated with the request and then uses the same Authy API method we used earlier to resend the code. Pretty straightforward, right?

Let's take a step back and see how we can use Authy to resend a verification code to an unverified user.

Sending a Token on Account Creation

In order to end up with a cleaner and decoupled design we'll encapsulate all of Authy's related features in an AuthyService. This class will hold a shared class instance of the AuthyApiClient class.

Once the user has an authyId we can send a verification code to that user's mobile phone.

When our user is created successfully via the form we have implemented, we send a token to the user's mobile phone asking them to verify their account in our controller. When the code is sent, we redirect our users to another page where they can enter the received token, completing the verification process.

Verifying the Code

Authy provides us with a tokens.verify method that allows us to pass a user id and token. In this case we just need to check that the API request was successful and, if so, set a verified flag on the user.

That's it for token verification! Let's provide a nice user onboarding experience, and send a confirmation message to our new user.

Sending the Confirmation Message

Just as we did for our Authy client, we create a single instance of the Twilio REST API helper. It will be called twilio_client in this example.

After that, it's straightforward - send an SMS using the Twilio Python helper library to the same number we used in messages.create().

Congratulations! You've successfully verified new user accounts with Authy. Where can we take it from here?

Where to Next?

In one simple tutorial, we've implemented account verification with Authy and Twilio, allowing your users to confirm accounts with their phone number! Now it's on you - let us know what you build on Twitter, and check out these other tutorials:

Appointment Reminders

Use Twilio to automate the process of reaching out to your customers in advance of an upcoming appointment.

Two-Factor Authentication with Authy

Use Twilio and Twilio-powered Authy OneTouch to implement two-factor authentication (2FA) in your web app.