Quick answer: Silent Network Authentication (SNA) is a verification method driven by the GSMA Open Gateway program's CAMARA APIs: the mobile operator itself proves that the device making a verification request holds the SIM it claims, so verification completes without an SMS OTP ever being sent. Orbit by Devotel ships SNA as an sna channel on the Verify API — your app hands over the operator-issued device token, and the network possession proof closes the loop. SNA depends on operator participation and works only where a carrier network API is configured, so the right answer is a chooser (SNA first, OTP fallback), not a switch.
Verification buyers comparing SMS OTP, SNA, passkeys, and magic links find plenty of vendor marketing on each, but few supplier explanations of how the carrier-side method works. This post walks what SNA is, how the CAMARA Number Verification flow runs end to end, when SNA beats SMS OTP (and when it does not), how to wire it on the Devotel Orbit Verify API, what happens when the deployment has no operator configured, and an FAQ.
What Silent Network Authentication actually is
SNA belongs to the GSMA Open Gateway program, the industry framework that exposes standardized operator capabilities through CAMARA, the open-source API project hosted by the Linux Foundation. Where SMS OTP sends a code the user retypes, SNA takes a different route: the operator runs the proof, and the application only passes identifiers back and forth.
The possession proof it produces is the strongest aspect of a login or signup flow. The operator confirms that the SIM inside the device currently asking to verify is the SIM bound to the target number. Nothing is typed, nothing is intercepted by a smishing page, and an attacker who cloned your onboarding page cannot divert a code that was never sent.
Where the alternatives sit:
- SMS OTP is universal — every phone with a working SMS path can participate — but the code is exposed to interception, real-time phishing, and SIM-swap attacks on the way to the user.
- Voice OTP works where SMS is unreliable and handles deep eye-sight or non-smartphone cases, at the cost of call delivery time and robocall-class carrier filtering.
- Email OTP decouples verification from the mobile network entirely but inherits the email account's reset surface and mail-delivery latency.
- Passkeys (WebAuthn/FIDO2) are the strongest UX on device-supported platforms and resist phishing by design, but enrollment depends on platform authenticators, and account recovery still needs a fallback.
- Magic links move the possession check to an email click, an acceptable trade for low-stakes consumer products.
Orbit by Devotel includes the CAMARA Number Verification route as a real shipped capability: the Verify API accepts sna as a send channel, and the request carries the device-bound network token the operator flow issued earlier. The same Open Gateway family also powers the SIM-swap signal the risk-screening post explains — that post owns the fraud-signal half; this one owns the authentication-choice half.
How the CAMARA Number Verification flow runs end to end
The flow is a three-party exchange among your app, the user's mobile operator, and the verification platform. Conceptually it completes in four steps:
- Token issue via the operator. The user's device, on cellular data (not Wi-Fi), acquires a short-lived network access token directly from its operator through the operator's Open Gateway endpoint. The CAMARA authorization model is OAuth2-based, and the token is scoped to one number-verification purpose.
- Possession check. The operator binds the request to the SIM currently presenting the cellular session. This is the proof step: the network itself attests that this device, right now, is on-network with that SIM.
- Verification completes with no OTP minted. Your backend sends the token to the verification API with the phone number. The API validates the pair against the operator and returns a verified verdict. No SMS was sent, so nothing can be intercepted in transit, throttled by a sender-registration gap, or retyped into a phishing page.
- Expiry. Operator tokens are deliberately short-lived. A speculative-collection attack that hoards tokens against a future verification fails because tokens expire before a replay window opens.
Note the cellular constraint: the proof only exists on the mobile data path. A user on Wi-Fi-only (or on a desktop session) cannot produce the operator token, so every SNA deployment needs a server-side fallback you control.
SNA vs SMS OTP: a comparison matrix
Choose the method per verification moment rather than globally. The trade-offs:
| Dimension | SNA (CAMARA) | SMS OTP | Passkeys | Magic link / email OTP |
|---|---|---|---|---|
| Coverage | Cellular-data users on participating operators only | Near-universal; works on any SMS-capable line | Devices with platform authenticators | Any mailbox |
| Latency | Sub-second network assertion; no delivery hop | Seconds-to-minutes of delivery variance plus user retype | Fast local ceremony | Mail delivery variance |
| SIM-swap resistance | Strong — the operator asserts current SIM possession; a cloned SIM cannot answer | Weak — codes route to whoever holds the SIM today | Strong — nothing reusable leaves the device | Depends on mailbox security |
| Phishing surface | Minimal — no secret to steal in transit | High — real-time phishing relays capture codes | Minimal by design | High — one click starts the attack |
| Fallback need | Mandatory (Wi-Fi-only, non-participating operator) | Optional but advisable | Recovery flow required | Optional |
SNA is the better first attempt for cellular app flows on participating operators because it removes the interception surface entirely; SMS OTP stays the safety net. That chooser logic is yours to keep: the compliance and risk posture on Orbit is tenant-owned (per the tenant-controls rule the verify buyer explainer lays out), and this comparison is a design aid, not a mandated default.
Wiring SNA on the Devotel Orbit Verify API
The wiring sits in the public API surface. A send from your backend:
POST /api/v1/verify/sendwithchannel: "sna", the recipient E.164 number into, and the operator-issued token in thedevice_tokenfield. When the device token is present on ansnasend, verification completes on the network possession proof and the API mints no OTP.- The usual OpenAPI reference documents the full channel enum —
sms,whatsapp,email,viber,voice,telegram,silent,rcs,flashcall,sna,totp,push,magic_link,backup_code— on the send schema, together with fallback chains (channels+fallback_config) you can use for the OTP safety net.
Beyond the send itself, two adjacent shipped surfaces matter to SNA integrators:
POST /api/v1/numbers/network-apis/number-verification:verifyis the standalone Silent Auth check in the Network APIs family — useful when you want the possession verdict as a signal without starting a verification session.POST /api/v1/risk/scorefuses SIM-swap recency, port-event (number-recycling) checks, and the SNA possession signal into one allow/review/deny verdict. Operator-asserted CAMARA signals outrank caller-held backups in that scoring, and the request accepts the samedevice_token-style access token to unlock the possession dip.
Keep token handling in your own app short and server-side: operator tokens go from the device to your backend to the Verify API, and a token missing on an sna send simply means the possession proof is not evaluated — the send cannot complete on nothing.
Fail-closed behavior when no operator is configured
SNA is operator-mediated, so a deployment can be configured without any carrier network-API credentials. Orbit's answer to that state is explicit and shipped: verification endpoints degrade to the caller-held signals they carry, and the operator-dependent dips report themselves unavailable rather than guessing.
Concretely:
- The Lookup
sim_swapfield falls tocoming_soonuntil a CAMARA operator is configured for the deployment. - The risk fusion endpoint lists unevaluated operator signals in
signals_unavailableand renders its verdict from the caller-held evidence that remains (roaming, reputation, recycling checks) — operator gaps downgrade gracefully, and anything less than an explicit network-confirmed possession match resolves to not-verified. - A boolean configuration endpoint reports whether CAMARA operator credentials are configured, so the dashboard can gate its live identity-verification tooling without exposing any secret.
That is the tenant-owned control stance applied to a carrier dependency: the platform does not pretend a coverage gap does not exist, and it does not invent a global policy for who may or may not use SNA. If your verification flows require the possession proof strictly, gate the sna channel on the configuration flag yourself.
FAQ
Is SNA the same as a silent network-auth push or a "silent" channel? No. Orbit's channel enum includes both silent and sna as separate values; the SNA path is the CAMARA Number Verification flow documented here, while the silent value refers to the notification-based silent channel. They should not be conflated on a send.
Does SNA work on Wi-Fi or desktop sessions? No. The possession proof requires the device to present an active cellular session to its operator. Design your fallback — SMS OTP, voice OTP, or passkeys — as a first-class path, not an afterthought.
How does SNA relate to SIM-swap detection? They are siblings in the same CAMARA/Open Gateway family. SIM-swap detection looks back for a recent SIM change (a fraud signal), while Number Verification proves current SIM possession (an authentication primitive). Orbit exposes both: the SIM-swap lookup post covers the signal side, and the risk-score endpoint can consume both at once.
Can SNA replace SMS OTP entirely? Only within participating-operator coverage and cellular-data contexts. In practice, teams run SNA-first with an OTP fallback chain — a configuration the Verify API's fallback channels model directly.
Is this mandated or required for compliance? No. SNA is an authentication choice, not a regulatory mandate, and nothing here is required to satisfy a compliance rule. Choose it where it strengthens your verification flow, and treat your compliance and risk posture as yours to set.
The takeaway
SMS OTP is the common currency of verification, but the currency is easy to steal in transit. Silent Network Authentication moves the proof onto the operator network itself, and the Orbit by Devotel Verify API carries it as a shipped sna channel beside the OTP family, with explicit fail-closed degradation where carrier access is absent. Read the trade-off matrix, wire the fallback you actually control, and treat SNA as the first attempt in your chooser rather than a promise the market has already made for you.