How Does One‑Click Mobile Number Login Work? A Deep Dive into the Process

One‑click mobile number login is a new type of authentication method. The evolution of login methods can be divided into several stages:

From both user experience and security perspectives, one‑click login is superior, and many apps now support the “device number one‑click login” feature, as illustrated below:

In the app, a masked phone number (with the middle four digits hidden) is displayed on the authorization page. After the user clicks the “Agree to authorize” button, the app obtains the full phone number from the carrier (since Android and iOS restrict direct access to the device number for privacy). With the full number, the app can log in using the device number. The following sections explain the underlying principles and process.

1. Basic principle of device‑number one‑click login

The key to one‑click login is the mobile data network. Data access uses the PPP protocol for point‑to‑point connections. At the physical layer, the mobile’s built‑in baseband module handles wireless signal modulation and demodulation.

The data access process consists of an access stage and a transmission stage. In the access stage, the phone carries IMSI information to connect to the MME (Mobility Management Entity). After the MME validates the IMSI via the HSS (Home Subscriber Server), it initializes the session and provides encrypted transmission support. In the transmission stage, data packets travel through the base station, S‑GW (Service Gateway), and P‑GW (PDN Gateway) to reach internet resources, while the carrier can obtain the user’s phone number through IMSI or GUTI.

The ability to retrieve the phone number is realized via the data gateway. Carriers can verify the identity of the connected user; the IMSI stored in the SIM card is recorded in the carrier’s database, ensuring that the base station can authenticate the user.

2. Implementation process in the app

(1) Obtain the masked phone number and invoke the authorization page – When the user opens the app and needs to log in, the app queries the carrier for the masked phone number. After carrier verification, the masked number is returned and cached in the carrier’s SDK, then displayed to the user.

(2) Retrieve the token for the masked number – After the user taps the “One‑click login” button, the app sends an authorization request to the carrier’s server. Upon successful verification, the carrier returns the masked number and a corresponding token.

(3) Obtain the application‑level authorization token (token_a) – The app sends a login request to its own server, carrying the masked‑number token, app ID, and signature. The server forwards these to the carrier’s server, which validates them and returns the full phone number. The app server then generates an application‑level token (token_a) and returns it to the app, which caches token_a and indicates a successful login.

(4) Use token_a for subsequent requests – For every request to the app’s backend, the client includes token_a. The server validates token_a and, if valid, processes the request.

Thus the one‑click mobile number login flow is completed.

Summary

(1) One‑click login enables password‑free, verification‑code‑free authentication, allowing users to log in within about two seconds.

(2) The process involves obtaining the masked number, retrieving the masked‑number token, acquiring the full phone number, and generating an application‑level token (token_a) before completing the login.

(3) Each of the three major carriers in China provides its own open platform (China Mobile – Internet Capability Open Platform, China Telecom – Tianyi Account Open Platform, China Unicom – WO+ Open Platform). To support all three, developers must integrate three separate SDKs, or use third‑party SDKs that aggregate the three, such as Alibaba Number Authentication Service, Chuanglan Flash Verification, Jiguang Authentication, or Mob Second‑Verification.