Authenticate features have moved to Flow Studio

Overview

Authenticate has moved to Flow Studio, Unifonic's journey orchestration platform. If you're reading this, you want to use Authenticate: it didn't go anywhere, it just got better. Two-factor authentication (2FA) now runs as a Flow Studio flow, still with two API calls, just as before.

The Verify call now returns the result in its own response and this if fully customizable.

What Authenticate was

Authenticate let clients add 2FA to their websites and apps with two endpoints:

1. Send 2FA generated a one-time password (OTP) and delivered it by SMS, WhatsApp, Email or Voice.
2. Verify 2FA took the code the end user typed and returned pass or fail.

No further setup was needed.

Why Authenticate is being deprecated

Flow Studio does everything Authenticate did and more, so Unifonic is consolidating 2FA there instead of maintaining a separate product. Clients gain:

• Built-in retries and channel fallback when a message isn't delivered (for example, WhatsApp first, then SMS)
• Handling for edge cases such as wrong numbers, blocked channels and expired codes
• A ready-made 2FA template they can adjust visually, without writing custom logic
• One platform for all their communication journeys

For end users nothing changes. Only the client's API calls change.

How 2FA works in Flow Studio

The 2FA flow generates the OTP, sends it, waits for the code, checks it, and answers the Verify call with the result. Each Authenticate endpoint maps to one Flow Studio URL.

The result comes back immediately because the Webhook Listener widget has Send response back turned on. Its rules compare the code the user entered with the OTP the flow generated, and return the matching status code and JSON body to the Verify call.

Step-by-step migration

Step 1: Set up the 2FA template

1. Log in to Flow Studio and open Templates.
2. Find the 2FA template and click Use this template.
3. Set the sender, the message template and the channels (for example, WhatsApp first, SMS as fallback).
4. Open the Webhook Listener widget:
   • Set Wait Time to how long a code stays valid, for example 5 minutes.
   • Check that Send response back is on, and adjust the response codes and bodies if your app expects a different format (see Verification responses).
5. Copy the Webhook URL from the Webhook trigger and the Webhook Listener URL. You need both in the next steps.
6. Publish the flow.

Step 2: Replace "Send 2FA" (start the flow)

Call the Webhook URL instead of the old Send 2FA endpoint. The API key is set in the Webhook trigger; copy it from there.

curl --location 'https://flow-api.cloud.unifonic.com/api/v1/execution/flow/{flowID}/execute' \ --header 'Content-type: application/json' \ --header 'X-API-KEY: {apiKey}' \ --data '{     "name": "{userName}",     "phone": "{userPhoneNumber}" }'

Response:

{ "message": "8e5943d1-c48c-4c67-8941-b67e00e8f40e" }

The value of message is the Execution ID. Save it against the user's login attempt; Step 3 needs it.

Step 3: Replace "Verify 2FA" (send the code, read the result)

When the user enters the code, send it to the Webhook Listener URL with the Execution ID from Step 2 in the path. Use the same API key.

curl --location 'https://flow-api.cloud.unifonic.com/api/v1/webhook/flows/{flowID}/execute/{executionID}' \ --header 'Content-type: application/json' \ --header 'X-API-KEY: {apiKey}' \ --data '{     "customer_response": "1605" }'

The result comes back in this same response, so your app can let the user in or show an error right away. There is no Step 4: no callback URL, no IP whitelisting.

Verification responses

The Verify call returns one of these. The first two are the template's defaults and can be changed in the Webhook Listener's Send response back rules; the codes and JSON bodies are yours to define.

More than one attempt: to let users retry a wrong code, the flow jumps back to the Webhook Listener after a failed check (for example, up to 3 tries). Every try gets its own immediate response.

Messages that never arrive: if the code isn't delivered on any channel, the user never submits it. Your app should offer Resend code, which calls Step 2 again and gets a new Execution ID. Delivery failures are listed in Flow Studio under Executions.

Open question: the exact HTTP status Flow Studio returns when the run is no longer waiting (expired or ended). Confirm with Flow Studio engineering before publishing this guide.

Full request flow

From the user asking for a code to your app getting the result, in two calls:

1. Your app calls the Webhook URL (Step 2). Flow Studio starts a run.
2. Flow Studio returns the Execution ID. Your app stores it.
3. Flow Studio generates the OTP and sends it (SMS, WhatsApp, Email or Voice, with fallback if set).
4. The user enters the code in your app.
5. Your app calls the Webhook Listener URL with the code and the Execution ID (Step 3).
6. Flow Studio checks the code against the one it generated.
7. Flow Studio returns the result in the same response: verified or failed.
8. Your app lets the user in or shows an error.

The old steps where Flow Studio called the client's callback URL are gone.

What clients need to prepare

• The 2FA template set up and published in Flow Studio (Step 1)
• The API key from the Webhook trigger
• Send 2FA code updated to call the Webhook URL and store the Execution ID
• Verify 2FA code updated to call the Webhook Listener URL and read the result from the response
• The response codes and bodies in Send response back matched to what your app expects
• A Resend code option in your app for expired or undelivered codes

Not needed anymore: a callback endpoint, callback authentication, or whitelisting Flow Studio's IP address.

Support and next steps

Your Unifonic account manager or technical contact can help you:

• Set up the 2FA template and the Webhook trigger's API key
• Match the verification responses to your app's format
• Test the full journey, including wrong, expired and undelivered codes
• Confirm the deprecation date for your Authenticate credentials