# Login in with sms pin using /oauth/token endpoint possible?

**URL:** <https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119>\
**Category:** Get Help\
**Tags:** token, passwordless\
**Created:** [April 5, 2017, 8:48pm UTC](https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119 "2017-04-05T20:48:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Termi](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@Termi](https://community.auth0.com/u/Termi)\
**Post date:** [April 5, 2017, 8:48pm UTC](https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119/1 "2017-04-05T20:48:12Z")

</div>

In response to:

> **[Auth0 Community](https://community.auth0.com)**
>
> Community for Auth0, the identity Infrastructure built for developers.

Would I also be able to use the /oauth/token endpoint using a password obtained through the passwordless endpoint?  
I tried to call `/passwordless/start` and use the sms pin as the “password” for the `/oauth/token` endpoint using the realm “passwordless” (also tried “sms”), however it gives me:

```
{
	"error": "access_denied",
	"error_description": "Unauthorized"
}

```

Isn’t that a valid flow?

---

<div class="post-metadata">

**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\
**Post date:** [April 6, 2017, 1:36pm UTC](https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119/2 "2017-04-06T13:36:58Z")

</div>

The `/oauth/token` endpoint does not support the passwordless flow. Instead, you can use the `/oauth/ro` endpoint, which supports the passwordless sms connection: [Authentication API Explorer](https://auth0.com/docs/api/authentication#authenticate-user)

```
POST https://tenant.auth0.com/oauth/ro
{
  "client_id": "YOUR_CLIENT_ID",
  "connection": "sms",
  "grant_type": "password",
  "username": "PHONE_NUMBER", 
  "password": "VERIFICATION_CODE", //the verification code
  "scope": "SCOPE"
}

```

---

<div class="post-metadata">

**Author:** ![brad2](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/brad2/32/8925_2.png) [@brad2](https://community.auth0.com/u/brad2)\
**Post date:** [September 14, 2017, 6:35am UTC](https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119/3 "2017-09-14T06:35:05Z")

</div>

This is no longer possible to do, is it? I’m wanting to do the sms authentication from the server as well, and get the access/id tokens back for that.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/login-in-with-sms-pin-using-oauth-token-endpoint-possible/6119/4 "2018-03-02T05:53:06Z")

</div>