# MCP for auth in 5 minutes: phone verification through your AI agent

> Source: <https://dev.to/rayas/mcp-for-auth-in-5-minutes-phone-verification-through-your-ai-agent-48om>
> Published: 2026-09-03 22:14:48+00:00

Most AI coding tutorials stop at "ask the agent to write code". This one is about giving the agent a tool it can call, an MCP server, so it can send and verify one-time codes while you're still building. I work at MyOTP.App and this uses our server, so read it with that in mind.

If you're on Claude Code, Claude Desktop, Cursor, Codex or anything else that speaks MCP, this takes about five minutes.

When you ask an agent to "add phone verification" with no tool attached, it writes code against an SDK it half remembers. Sometimes that SDK doesn't exist in the version it picked. You find out at runtime.

With the MCP server attached, "send a code to my number" is a tool call. The agent sends a real message, you get a real SMS, and only then do you ask it to write the integration. The code comes after the proof.

There's nothing to install. `npx`

fetches it on demand.

`*`

while you're developing locally.

```
claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp
```

Claude Desktop, in `claude_desktop_config.json`

:

```
{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": { "MYOTP_API_KEY": "your-key" }
    }
  }
}
```

If your client can't launch local processes, point it at the hosted server instead: `https://mcp.myotp.app/mcp`

, key in the `X-API-Key`

header or as `Authorization: Bearer`

. Add `108.61.176.199`

to your key's IP allowlist for that, since hosted calls reach our API from that address and not from your machine.

Ten tools. The four you'll use most:

`generate_otp`

sends a code over SMS, WhatsApp or Telegram and returns a transaction id.`verify_otp`

checks what the user typed.`check_otp_status`

tells you whether the message was queued, sent, delivered or failed, which is where you look first when "the code never arrived".`extend_otp`

gives a slow user more time without sending a new code.The rest cover the account: `get_account_info`

, `get_account_status`

, `get_usage_report`

, and three that exist so an agent can run without a human in the loop. `create_account`

registers a new account and returns a key, `get_topup_quote`

and `top_up_credits`

buy credits over HTTP 402 through Stripe, by card or USDC. An agent that runs out of credits can refill and carry on.

The MCP server is a tool for the agent, not a dependency for your app. Your application still calls the REST API from the server side with the key in the `X-API-Key`

header. The published examples for Next.js, Express, Flask, Django, Rails and Laravel are in the brntech/myotp-agentkit repo and are the copy-paste starting points.

IP allowlisting. A key created from your laptop is allowlisted to your laptop's public IP. When the first call from a server or from the hosted MCP endpoint comes back with a 403 that says the IP isn't allowed, that's the cause, not the key.

Disclosure again: I work at MyOTP.App. If something here is wrong, say so in the comments and I'll fix the post.