Customer Authentication settings¶

Status: Current | Last reviewed: 2026-10-06

This screen decides how agents in your tenant confirm who a caller is. Each agent chooses which methods to offer and how much proof to require (Customer Authentication); this page sets what those choices resolve against. Until a tenant admin turns it on here, no agent in the tenant can verify anyone.

You need the tenant Admin role. Settings → Tenant Settings is visible only to tenant admins and platform admins.

Turn it on¶

1. Open Settings → Tenant Settings → Customer Authentication.
2. Turn on Allow agents to verify callers.
3. Select Save settings.

Changes apply within about a minute — no restart. A caller already verified on a live call stays verified.

Identity source¶

Identity source is what an agent set to "Tenant default" uses:

• TrueServe (built in) — TrueServe stores passkeys and verified contact details for you. No further setup.
• Your own identity provider — send callers to an existing customer login (Amazon Cognito, Auth0, Okta) instead. Fill in:
  • Issuer URL — where your provider publishes its configuration, for example https://tenant.auth.us-east-1.amazoncognito.com. Must be https.
  • Client ID — from the app registration in your provider.
  • Client secret — stored encrypted and never shown back; leave unchanged to keep the current secret, or empty if your provider uses a public client with PKCE.

Delivery¶

• Send codes and links by — the SMS integration that texts one-time codes and passkey links. Same as multimodal links reuses whatever already sends your multimodal links, so if multimodal SMS works, so does this. An agent's own passkey/OTP settings can pick a different integration.
• Email from-address — sender for emailed codes. Leave empty to use the platform sender.

In Preview, codes and links appear in the test phone's Messages app by default. If your deployment exposes SMS, a tester can deliberately route them through the real integration to the ANI entered in Template Variables.

For recordings without real passkey setup, enable Simulate authentication in Preview in the agent's Customer Authentication capability, under Passkey. This is an agent setting; the tenant's Allow agents to verify callers switch must still be on. See simulated authentication.

Turning it off¶

Switch off Allow agents to verify callers and save. All new verification in the tenant stops immediately. Agent settings are left untouched, so turning it back on restores them exactly. Callers already verified on live calls stay verified until those calls end.

Troubleshooting¶

• An agent reports "Customer Authentication is not enabled for this tenant" — the toggle here is off, or the settings were never saved.
• Codes and links aren't delivered — check the Send codes and links by integration. The agent's capability form also warns inline when no SMS integration is available.
• Saving is rejected asking for an issuer URL or client ID — you selected Your own identity provider; both fields are required for it.