How to Build Passwordless Auth With Twilio Verify in Go

Summary

The tutorial builds a passwordless authentication flow in Go that uses Twilio Verify to send and validate one-time passwords (OTPs) by SMS, avoiding the need for users to manage passwords. It defines a small net/http API with GET and POST handlers for "/" and "/verify": the first collects a mobile number and starts verification, while the second accepts the received code and displays the result. The setup covers Go 1.23 or later, module dependencies, dotenv configuration for the Twilio Account SID, Auth Token, and Verify Service SID, plus session handling for the phone number. The verification check calls Twilio's CreateVerificationCheck() and renders success or failure using templates; running go run main.go starts the server on port 8080 for testing.

Takeaways

1. 1

   The flow has four handlers: GET and POST for "/" to collect a phone number and send an OTP, plus GET and POST for "/verify" to accept and validate the code.

2. 2

   The .env configuration requires TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, and TWILIO_VERIFY_SERVICE_SID; the tutorial also installs Twilio's Go helper library and Gorilla session packages.

3. 3

   verifyOtpCode retrieves the phone number from the session and calls CreateVerificationCheck(); an approved response renders "Verification was successful," while other outcomes render failure.