---
name: "human-auth-sms-2fa"
description: "Handle SMS verification codes and 2FA TOTP codes from Human Phone. Covers OTP entry, code verification, and multi-factor authentication flows."
metadata: {"openclaw":{"triggers":{"any":["sms","2fa","otp","verification code","totp","authenticator","verify","one-time","mfa","two-factor","confirmation code"]}}}
---

# Human Auth: SMS / 2FA Verification

Use this when an app requires a verification code sent via SMS, email, or generated by an authenticator app.

## When to Trigger

- App shows "Enter verification code" or "Enter OTP" screen.
- App sent an SMS to the user's phone number and is waiting for the code.
- App requires a TOTP code from Google Authenticator, Authy, etc.

## How to Call

```
request_human_auth(
  capability: "sms",
  instruction: "Please enter the verification code sent to your phone for [app/service].",
  uiTemplate: {
    allowTextAttachment: true,
    requireArtifactOnApprove: true,
    title: "Verification Code Needed",
    summary: "Enter the SMS or authenticator code."
  }
)
```

## After You Receive the Artifact

The artifact is a JSON file with a `value` field. The `value` is NOT in the session log — you must read the file.

1. **Read the code:** `read(<artifact_path>)` to get the actual code value.

2. **Check the current screen.** The verification input may still be visible, or the app may have moved to a different screen during the wait.

3. **If the input field is still visible:** tap it to focus, then `type_text(<code>)`.

4. **If the app moved away:** press `keyevent KEYCODE_BACK` to return to the verification screen, or re-navigate to it.

5. **Tap Verify / Submit / Continue.**

6. **Check if verification succeeded.** If the app shows an error (code expired), you may need to request a new code and call `request_human_auth` again.

## Tips

- TOTP codes rotate every 30 seconds — act quickly after receiving one.
- SMS codes typically last 1-5 minutes.
- Delete the artifact after use: `exec("rm <artifact_path>")`.