Authentication
How Voice MCP authenticates callers — a live DTMF PIN prompt for unknown callers, plus a fail-closed SMS one-time-passcode configuration being wired in.
Voice MCP authenticates callers so that a phone call can act on your CRM. The live control today is a PIN prompt for callers the system doesn't recognize.
PIN for unknown callers
When an unrecognized caller reaches the line and your workspace has the "require PIN for unknown callers" control enabled, the agent prompts for a PIN. The caller enters it on the dial pad (DTMF), Pact verifies it, and — on success — marks the caller authenticated for the session.
This is the live caller-auth control
The DTMF PIN prompt for unknown callers is enforced on the live call path. Turn it on from your voice admin settings, and set per-user PINs there as well.
SMS one-time passcode (being wired in)
Voice MCP also carries an SMS one-time-passcode (OTP) configuration. Its per-tenant setting, voice_otp_required, is fail-closed by default: the OTP requirement can only be lifted by an explicit per-tenant opt-out. A missing configuration row, a NULL value, a lookup error, or the absence of any environment variable all resolve to "OTP required." There is deliberately no environment-variable override.
Not yet a live guarantee on the main path
Treat the SMS OTP as a fail-closed configuration that is being wired into the call flow, not as a live possession-factor guarantee today. On the current main path a recognized caller is admitted on caller ID alone — and caller ID is spoofable — with no SMS possession check yet enforced. This is a known gap slated for a later wave. Do not rely on SMS OTP as an active control; the enforced control today is the DTMF PIN for unknown callers above.