# During Email/Phone Verification Cotter's email/phone number verification is generally used to check if the email or phone number is active. For websites with no companion app, it is **also used as the main method of login**. Cotter can return OAuth tokens when the user's email/phone numbers are verified, and the `authentication_method` will be set as `OTP`. {% tabs %} {% tab title="React Native SDK" %} In the React Native SDK, you would follow this guide to [open Cotter's verification module.](https://app.gitbook.com/@putrikarunia/s/cotter/~/drafts/-M4HLUONb9Nh8ea1pSqf/verify-email-and-phone-number/react-native-sdk#step-2-call-cotters-verify-function) When the user's email or phone number is successfully verified, [you'll receive information about the user and a signature from Cotter.](https://app.gitbook.com/@putrikarunia/s/cotter/~/drafts/-M4HLUONb9Nh8ea1pSqf/verify-email-and-phone-number/react-native-sdk#step-4-receiving-the-token-in-onsuccess-or-onerror) To also receive OAuth Tokens, modify your code by adding `getOAuthToken = true` in the parameters: ```javascript import { Verify } from 'react-native-cotter'; class Register extends PureComponent { ... openCotterAuth = async () => { var verify = new Verify( 'https://js.cotter.app/app', 'https://www.cotter.app/api/v0', 'myexample://auth_callback', API_KEY_ID, this.onError, this.onSuccess, (getOAuthToken = true), // 👈 Add this parameter ); await verify.openAuth('EMAIL'); }; ... } ``` The response `OnSuccess` will be: ```javascript { "identifier": { "ID": "2ddc26f6-f392-4d7e-8607-1f57d41da045", "created_at": "2020-04-05T04:50:55.931771Z", "deleted_at": null, "device_name": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/15E148 Safari/604.1", "device_type": "BROWSER", "expiry": "2020-05-07T03:34:58.729745Z", "identifier": "hello@gmail.com", "identifier_type": "EMAIL", "public_key": "FvozWVGHo9lWE5ilLOF...", "timestamp": "2020-04-07T03:34:58.729745Z", "update_at": "2020-04-07T03:34:58.733779Z" }, "token": { // You can ignore this if you're using the oauth_token "expire_at": "1588822498", "identifier": "hello@gmail.com", "identifier_id": "2ddc26f6-f392-4d7e-8607-1f57d41da045", "identifier_type": "EMAIL", "receiver": "", "signature": "XIbztHLKQSqzbnuBgyC+GfAK...", "timestamp": "1586230498" }, "oauth_token": { // 👈 NEW OAuth Tokens 👈 "access_token": "eyJhbGciOiJFUz...", "auth_method": "OTP", "expires_in": 3600, "id_token": "eyJhbGciOiJFUz...", "refresh_token": "94:qv2SAJN5u2u...", "token_type": "Bearer" } } ``` {% hint style="success" %} Cotter's React Native SDK **automatically** **store your tokens securely** inside the device's secure storage. {% endhint %} {% endtab %} {% tab title="API for Mobile Apps" %} Using the [API for Mobile Apps](/sdk-reference/api-for-other-mobile-apps/api-for-mobile-apps.md), you would follow this guide to [get the identity of the user.](/sdk-reference/api-for-other-mobile-apps/api-for-mobile-apps.md#step-3-request-tokens-and-identity) When the user's email or phone number is successfully verified, [you'll receive information about the user and a signature from Cotter.](/sdk-reference/api-for-other-mobile-apps/api-for-mobile-apps.md#request-tokens) To also receive OAuth Tokens, add a query parameter `oauth_token=true` in the http request: ``` https://www.cotter.app/api/v0/verify/get_identity?oauth_token=true ``` The full request would be: ``` curl -XPOST \ -H 'Content-type: application/json' \ -H 'API_KEY_ID: ' \ -d '{ "code_verifier": "", "authorization_code": "", "challenge_id": , "redirect_url": "" }' 'https://www.cotter.app/api/v0/verify/get_identity?oauth_token=true' ``` You'll get the following response: {% code title="JSON Response" %} ```javascript { "identifier": { "ID": "2ddc26f6-f392-4d7e-8607-1f57d41da045", "created_at": "2020-04-05T04:50:55.931771Z", "deleted_at": null, "device_name": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/15E148 Safari/604.1", "device_type": "BROWSER", "expiry": "2020-05-07T03:34:58.729745Z", "identifier": "hello@gmail.com", "identifier_type": "EMAIL", "public_key": "FvozWVGHo9lWE5ilLOF...", "timestamp": "2020-04-07T03:34:58.729745Z", "update_at": "2020-04-07T03:34:58.733779Z" }, "token": { // You can ignore this if you're using the oauth_token "expire_at": "1588822498", "identifier": "hello@gmail.com", "identifier_id": "2ddc26f6-f392-4d7e-8607-1f57d41da045", "identifier_type": "EMAIL", "receiver": "", "signature": "XIbztHLKQSqzbnuBgyC+GfAK...", "timestamp": "1586230498" }, "oauth_token": { // 👈 NEW OAuth Tokens 👈 "access_token": "eyJhbGciOiJFUz...", "auth_method": "OTP", "expires_in": 3600, "id_token": "eyJhbGciOiJFUz...", "refresh_token": "94:qv2SAJN5u2u...", "token_type": "Bearer" } } ``` {% endcode %} {% endtab %} {% tab title="Other SDKs (coming soon)" %} We'll add support for JS, Android and iOS soon 😉. Stay tuned! {% endtab %} {% endtabs %} {% hint style="warning" %} **Tokens must be stored securely within your application** Use [Android Keystore](https://developer.android.com/training/articles/keystore) for Android and [iOS KeyChain](https://developer.apple.com/documentation/security/keychain_services) for iOS apps. {% endhint %} ### Getting and Removing tokens from the Storage You need to pass the `access_token` to your backend server on every API calls. You also need to remove the tokens from storage to log out your users. Check out how to do that here: {% content-ref url="/pages/-M4I5Ed9v0BbC7OxzSFn" %} [Storing and Removing Tokens](/getting-access-token/storing-and-removing-tokens.md) {% endcontent-ref %} ### Renewing Expired Tokens Access tokens and ID tokens expires in 1 hour. When they're expired, you need to use the `refresh_token` to get new tokens. Check out how to renew expired tokens: {% content-ref url="/pages/-M4I0B0i0yghkR8yjphX" %} [Renewing Expired Tokens](/getting-access-token/renewing-expired-tokens.md) {% endcontent-ref %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.cotter.app/getting-access-token/older-api/getting-the-tokens/during-authentication/during-email-phone-verification.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.