Hello Yclas friends!
A new Yclas release has been deployed last Friday. As you always know we work hard to offer the best platform for people that want to create a marketplace or a classified site. Today we would like to introduce the 2 step SMS authorization for login.
What is it?
The 2 steps SMS authorization is a feature that allows users to log in to their sites/accounts no matter if they are admins or just users, all with 100% security. Admins must request the mobile phone number of their users and enable the SMS auth via the admin panel. Then, when a user is going to log in they can do it via SMS, where they will receive an SMS with a code to their phone and then put it on the site to log in. Easy.
How to enable 2 steps SMS authorization
For admins who want to offer this new feature to users and customers, you must follow the next steps:
- Admin must register to Clickatell
- On Clickatell dashboard, choose SMS integrations on the left sidebar
- Click Activate Now and set up Billing Details. You can calculate the pricing here
- Now that the integration is activated, choose SMS integrations again and copy the API key
- In your website admin panel, Settings -> General, enable 2 Step SMS Authentication and paste the API key into the Clickatell field
- Press Save
You can find more information and the steps on our documentations page
SMS codes or an authenticator app? Choosing two-step login in 2026
Update: the Clickatell steps above no longer apply. Today you turn on two-step SMS login under Admin panel > Integrations > 2Factor. Tick "Enable 2 Step SMS Authentication", paste your key into "2Factor API Key", save, then choose your main country under Settings > General > Regional (see the current guide). Yclas also offers a free alternative: two-step login with Google Authenticator, listed on the features page. Which one should you turn on?
Why any second step is worth it
In a 2023 Microsoft study of Azure Active Directory accounts, "How effective is multifactor authentication at deterring cyberattacks?", multifactor authentication cut the risk of compromise by 99.22% overall, and by 98.56% for accounts whose passwords had already leaked. The authors also found that authenticator apps protected better than SMS. For a marketplace, where a hijacked seller account can be used to post scam listings or message buyers, that protection matters.
The weakness of SMS
SMS codes are only as safe as the phone number. In a February 2022 alert, the FBI reported 320 SIM-swap complaints with about $12 million in losses from 2018 to 2020, and 1,611 complaints with more than $68 million in losses in 2021 alone. In a SIM swap, criminals move a victim's number to their own SIM and receive the codes. The US standards body NIST treats this as a known risk: its SP 800-63B-4 guideline (2025) lists SMS and phone-call codes as a "restricted" authenticator. Services that use them must make another kind of authenticator available, and are told to consider warning signs such as a SIM change or number porting.
| SMS code (2Factor) | Authenticator app (Google Authenticator) | |
|---|---|---|
| Cost to you | You pay 2Factor for every code sent | Free |
| What members need | A mobile number with coverage | A smartphone with the app installed |
| Main risk | SIM swap. If your 2Factor balance runs out, members with a number on their profile can't finish signing in | Losing the phone that holds the app |
| Best for | Markets where people expect phone-based login | Most sites, and admin accounts in particular |
A practical setup
- Turn on the authenticator app first, and use it on every admin and moderator account, because those accounts control payments and listings.
- Add SMS only if your members expect it, for example in markets where phone-number login is the norm. Keep an eye on your 2Factor balance: the Yclas guide warns that members with a number on their profile can't sign in when it runs out.
How does it work
As mentioned above it is really easy to use, but here you have step by step on how it works:
- A user registers on your website or posts an ad
- A user account is created and the user goes to the Edit Profile page and enters his phone number
- After the update of the profile details, the user will get a verification code in a message on his mobile phone which will need to enter on the next page
- Now the user is authenticated and Two-step SMS authentication is enabled on his account
If you have any questions, suggestions, or need help, contact us!
