Alibaba Cloud Phone Sign-In (Recommended for China)

Enable Phone Number Verification Service

First, make sure your Alibaba Cloud account has enabled Phone Number Verification Service and can call the Dypnsapi SMS verification APIs.

Official API doc: SendSmsVerifyCode

Alibaba Cloud documents SendSmsVerifyCode as the SMS verification-code sending API under Dypnsapi. It uses API version 2017-05-25, and the permission action is dypns:SendSmsVerifyCode.

Create and Authorize a RAM User

Use a RAM user AccessKey instead of an Alibaba Cloud root account AccessKey.

1. Log in to the Alibaba Cloud RAM Console
2. Go to Identities → Users
3. Click Create User
4. Fill in the logon name and display name
5. Select OpenAPI Access as the access mode
6. After creating the user, grant it the permissions needed by Phone Number Verification Service

For a narrow policy, allow only the SMS verification APIs used by this project:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dypns:SendSmsVerifyCode",
        "dypns:CheckSmsVerifyCode"
      ],
      "Resource": "*"
    }
  ]
}

During initial debugging, you can also use Alibaba Cloud's managed policies for Phone Number Verification Service and narrow the permissions later.

Get AccessKey ID and AccessKey Secret

Official doc: Create an AccessKey pair

1. Log in to the Alibaba Cloud RAM Console
2. Go to Identities → Users
3. Open the RAM user you created
4. Open the Authentication or AccessKey tab
5. Click Create AccessKey
6. Complete the security verification prompts
7. Copy and save both values immediately:
   • AccessKey ID → ALIBABA_CLOUD_ACCESS_KEY_ID
   • AccessKey Secret → ALIBABA_CLOUD_ACCESS_KEY_SECRET

AccessKey Secret is displayed only once when it is created. If you lose it, disable the old key and create a new AccessKey.

Set Local and Production Environment Variables

For local development, add them to apps/server/.dev.vars:

ALIBABA_CLOUD_ACCESS_KEY_ID=your-access-key-id
ALIBABA_CLOUD_ACCESS_KEY_SECRET=your-access-key-secret

For production, add them to apps/server/.env.production:

ALIBABA_CLOUD_ACCESS_KEY_ID=your-access-key-id
ALIBABA_CLOUD_ACCESS_KEY_SECRET=your-access-key-secret

.env.production is only used to bulk-push Cloudflare Workers Secrets. It does not participate in frontend builds and should not be committed.

Push Production Secrets

Before deploying to Cloudflare Workers, push the production credentials to Workers Secrets:

pnpm -F server secrets:bulk:production

After this succeeds, the Worker runtime can read env.ALIBABA_CLOUD_ACCESS_KEY_ID and env.ALIBABA_CLOUD_ACCESS_KEY_SECRET. Re-run the same command whenever you rotate the credentials.

Keep the Alibaba Cloud Verification Parameters Unchanged

The built-in provider locks these parameters according to Alibaba Cloud's SendSmsVerifyCode documentation:

const ALIYUN_SMS_VERSION = "2017-05-25";
const ALIYUN_SMS_SIGN_NAME = "速通互联验证码";
const ALIYUN_SMS_TEMPLATE_CODE = "100001";

Do not change these values:

This integration uses Dypnsapi's SMS verification API, not the ordinary Dysmsapi SendSms API. Do not replace the template code with an SMS_... code from the ordinary SMS service.

Verify Phone Sign-In Locally

Start the server and web app, then choose phone sign-in on the login page:

pnpm dev:server
pnpm dev:web

When the user requests a code, the frontend calls:

POST /api/auth/phone-number/send-otp

When the user submits the code, it calls:

POST /api/auth/phone-number/verify

The server converts the +86 E.164 number into CountryCode=86 and the local phone number required by Alibaba Cloud. Alibaba Cloud then generates, sends, and verifies the code.