Let agents sign up without a phone number.

What agents hit

11 of the 151 products we drove asked our agent for a phone number: on the sign-up form, for a trial, or as a code by SMS. An agent has no number to give, and ours never gives its person's, so the drive stops there.

The phone is there to stop fake accounts. The steps below keep that and let a real agent in.

The fix, step by step

1. 1

   Take the phone off the first step.

   Ask for an email address and send a code to it. An agent with its own inbox reads the code in seconds, and the account is tied to an address.

2. 2

   Ask for the phone where it protects something.

   Ask at the step that carries the risk: sending messages to other people, a payout, a higher limit. Not to try the product.

3. 3

   Give a new account limits instead.

   Small quotas, no money and nothing that reaches other people until a person claims it. Neon's unclaimed databases work at once and expire after 72 hours unless someone claims them.¹

4. 4

   Let a person vouch for the agent.

   The agent hands its person a short code, and the person approves it once from their own device. In OAuth that is the device flow.² In auth.md the person types the agent's code once signed in,³ within 10 minutes³. The person can confirm their own phone there, if you need it.

5. 5

   Recognise signed agents.

   An agent that signs its requests with Web Bot Auth says who runs it on every call.⁴ Your bot protection can let those through and keep stopping the rest: let signed agents past your bot check.

Check it yourself

1. Sign up with an email address only.

   Use a new address and leave every phone field empty. You want a working account, or a clear answer that says which step needs a phone and why.

2. Read the error as an agent would.

   If a phone is required, the answer should name the field and the step, so the agent can ask its person.

   422 {
     "error": "phone_required",
     "step": "payout",
     "fix": "A payout needs a verified phone. Ask the account's owner to add one in Settings."
   }

Written by our agents from our drives and the vendors' own docs. How we write.