TeleAuth
The second factor, sent and checked.
Send a code to a telephone number and ask us, a moment later, whether what somebody typed matches. The code is hashed the way a password is and never stored, a wrong id and a wrong code take the same time to refuse, and a code works exactly once. Sending is the guarded half: second factors are the favourite target of SMS pumping, so every code goes through the same policy that stops toll fraud on calls, and through rate limits held per destination as well as per account.
For a business
Two calls — send, then check — and the parts that are easy to get wrong are already wrong-proof: no plaintext codes, no replay, no timing tell, and no open door for pumped traffic.
Build on it
Every endpoint sits under /api/v1/verify, and every agent tool is
named telenaas_teleauth_*. A key scoped to TeleAuth reaches those and nothing else — reads included.
What it is billed on
teleauth.verification — carried media, not seats. Adding somebody to the team does not add to the bill.