# ADR-005: Mandatory Mobile Identity with OTP

| Field | Value |
| --- | --- |
| Status | Accepted |
| Date | 2025-06-01 |
| Deciders | Product + Platform Architecture |
| Supersedes | — |
| Superseded by | — |

## Context

Iranian market users commonly authenticate with mobile numbers. Email-only accounts create incomplete identity for SMS, payments, and support.

## Decision

Mobile number is mandatory for all platform users and must be verified via SMS OTP (Payamak provider). Keycloak login supports password and mobile OTP tabs. Core stores `users.mobile` (unique) and `mobile_verified`.

## Consequences

### Positive

- Unified identity key across modules
- Ready for SMS notifications and recovery

### Negative

- Dependency on SMS provider availability
- Users without Iranian mobiles need future exception paths

## Alternatives Considered

1. Email-primary identity
2. Optional mobile

## Related Documents

- [Identity Architecture](../identity-architecture.md)
- [Provider Registry](../../provider-registry.md)
- [Glossary](../../glossary.md)