Skip to main content

Phone (RCS)

The Phone Web Identity links a phone number to a Nostr public key so users can receive Lightning payments via text messages or messaging apps.

Identifier Format​

Phone numbers must be strictly normalized to the international E.164 standard.

  • Rules: Must begin with a +, followed by the country code, followed by the subscriber number, with all spaces, dashes, and parentheses removed.
  • Raw Format: +12345678901
  • Resolved URI: phone:+12345678901

Privacy Model: Hashed (Strict)​

Like Email, Phone numbers are highly sensitive personally identifiable information (PII). Zapf treats Phone as a High Privacy identity.

The raw identifier is stripped from all public Nostr events. The Identity Connection Connection Key is exclusively a hash of the URI string. Senders must know the recipient's phone number to zap them.

Verification Flow (RCS OTP)​

Zapf recommends using modern RCS (Rich Communication Services), or fallback SMS, to deliver a One-Time Password (OTP) code to the user's device.

Upon entering the 6-digit code into the IA's dashboard, the IA issues the IA Attestation.

Security and Evidence​

Similar to the Email flow, Phone verification generates an ephemeral, local proof of ownership.

  • No Evidence Sharing: Phone OTP verification is not backed by a public URL, so cross-IA re-verification is not possible. Each IA must independently deliver and verify an OTP.
  • Independent Verification: If a user wants attestations from multiple IAs, each IA must independently send and verify an RCS OTP code to that phone number.