Owner-affiliated coverage This page covers a company in which Cleartext’s owner has a financial interest. Ownership and funding
Question Identity
What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?
MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.
What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP? MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it. Source: https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/ (Cleartext, verified 2026-09-24)
How it works, according to the company #
Glide Identity (Glide.id) says MagicalAuth replaces SMS one-time passcodes with verification through the mobile network. In the company’s words, it “confirms identity using the SIM’s cryptographic link to the network”.[1]
The points below are the company’s own description, not something Cleartext has tested:
- No codes. The company says authentication completes in under one second, with no code for the user to read or type.[1]
- Fallback. The company says that if a device or operating system doesn’t support SIM authentication, it automatically switches to alternatives such as passkeys or email links.[1]
- Integration. The company lists SDKs for iOS, Android and the web (JavaScript), plus a REST API.[1]
The developer documentation requires a login, and pricing isn’t published. Glide unveiled MagicalAuth, together with SuperPasskey, at Authenticate 2025, the FIDO Alliance’s conference, in October 2025.[2] The company describes SuperPasskey as passwordless authentication that combines passkeys with SIM verification.[3] In August 2026 Glide announced a beta of what it calls “carrier-native cryptographic authentication” across AT&T, T-Mobile and Verizon; the press release includes a quote from a Verizon Business executive.[4] Biometric Update covered the three-carrier launch.[5]
How it differs from SMS OTP and from plain number verification #
| SMS OTP | Number verification | MagicalAuth, as Glide describes it | |
|---|---|---|---|
| What the check relies on | A code sent by text message, which the user types back | The operator confirming a request comes from the SIM tied to the number | The SIM’s cryptographic link to the network, in the company’s words |
| Code for the user to type | Yes | No | No, according to the company |
| Interface | Text messages | The CAMARA Number Verification API | The company’s SDKs and REST API |
| When it can’t run | Not applicable | Needs the cellular data path | Falls back to passkeys or email links, according to the company |
| Independently tested by Cleartext | Not applicable | No | No |
Versus SMS OTP. An SMS code is something the user receives and types, so whoever receives the text, or talks the user into reading it out, can use it. That is the weakness behind SIM swap attacks and OTP bots. Glide positions MagicalAuth against SIM swap; whether it holds up against a SIM swap or eSIM transfer carried out at the carrier has not been independently verified.
Versus plain number verification. Number verification, standardized as a CAMARA API, confirms that a request comes from the SIM tied to a phone number.[6] Glide describes its own approach as SIM-based cryptographic authentication. The difference matters, but we have not independently tested either. Our carrier-based authentication answer sets out the three forms, and the number verification vs silent network authentication comparison covers the most common one.
Glide is not alone in the market. In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.[7] Prove, Twilio, Vonage, Sinch, Infobip, Telesign and IPification also offer network-based or SMS-alternative verification.
What we don’t know yet #
Our sources don’t answer these questions. Until they are answered, treat the company’s claims as claims.
- NIST classification. How NIST SP 800-63B-4 would classify SIM-based cryptographic authentication. Our sources don’t address it. For where SMS stands, see SMS OTP under NIST 800-63-4.
- Real-world coverage in the beta. Which devices, operating systems and plans work, and how often the fallback triggers.
- Pricing and carrier dependence. Pricing isn’t published, and the contractual dependence on carriers isn’t described in our sources.
- Independent security assessment. We found none in our sources.
- SIM swaps and eSIM transfers at the carrier. The company positions MagicalAuth against SIM swap. How it handles a SIM swap or eSIM transfer performed at the carrier has not been independently verified.
About the company #
Glide Identity is a US company. In October 2025 it raised a Series A of more than $20 million led by Crosspoint Capital Partners,[8] and in February 2026 it was named one of 10 finalists for the RSAC 2026 Conference Innovation Sandbox contest.[9] Its products, memberships and dated milestones are on the Glide Identity topic page.
Cleartext’s owner has a financial interest in Glide Identity. This page follows the same sourcing rules as every other answer, and under our policy no company reviews an answer before publication. See ownership and funding.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
- [1]MagicalAuth (product page)
- [2]Press (company press page)
- [3]Glide.id home page (product overview)
- [4]Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon
- [5]Glide brings SIM-based authentication to all major US carriers
- [6]CAMARA project
- [7]Aduna and major U.S. carriers push network-based authentication as SMS code alternative
- [8]Glide Identity: $20 million from Crosspoint (deal report)
- [9]Finalists announced for RSAC Innovation Sandbox Contest 2026
What this means for you #
Banks & credit unions
Treat MagicalAuth as a product to evaluate, not a proven replacement for SMS OTP. Before a pilot, ask Glide Identity for an independent security assessment, how it handles eSIM transfers and SIM swaps at the carrier, and how it expects the method to be classified under NIST SP 800-63B-4. Keep a device-bound credential for account recovery.
Fintechs & payment firms
Ask for coverage figures for your own customers’ carriers, devices, operating systems and plans, and for how often the fallback to passkeys or email links triggers. Pricing isn’t published, so get it in writing, and ask what happens to the service if a carrier agreement changes.
Developers & identity teams
The company says it offers iOS, Android and web (JavaScript) SDKs and a REST API; its developer documentation requires a login. Ask which network APIs sit underneath, test the fallback path on purpose, and log which method each login actually used so you can measure fallback rates yourself.
Follow-up questions #
- Is MagicalAuth the same as number verification?
- Not as Glide Identity describes it. Number verification (the CAMARA API) confirms that a request comes from the SIM tied to a phone number; Glide describes its approach as SIM-based cryptographic authentication. We have not independently tested either.
- What happens on a phone that doesn’t support SIM authentication?
- According to the company, it automatically switches to alternatives such as passkeys or email links. How often that happens in practice isn’t documented in our sources.
- Which US carriers does it work with?
- In August 2026 Glide announced a beta of carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon, according to its press release. Which devices, operating systems and plans work in the beta isn’t documented in our sources.
- How much does MagicalAuth cost?
- Glide Identity doesn’t publish pricing.
- Is Glide Identity the same company as other businesses called Glide?
- No. Several unrelated companies use the name Glide, including a UK fibre company, an embedded-banking fintech and a no-code app builder. Glide Identity’s brand and domain is Glide.id.
People also ask #
What is carrier-based authentication?
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.
Full answerWhat is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerIs SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerHow can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/
Markdown link
[What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?](https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published as owner-affiliated coverage, written only from Cleartext’s Glide Identity fact sheet and the sources listed. |