Authyo

@Authyo verify the session token from the Authorization header and show me the user's email and account status.

The session token is valid and belongs to user ID `usr_8k3mQ9pL`. The verified identity shows email `alex@example.com`, account status `active`, and session created 14 minutes ago. The token itself is not returned in this response for security reasons. You can now proceed with authenticated operations for this user.

This read-only verification is the foundation of session management. The MCP never returns the raw JWT in responses, only the decoded identity claims. Requires your Authyo API key with `session:read` scope. Use this before performing sensitive actions to confirm the user is who they claim to be.

@Authyo send a one-time password to mask ID `msk_7hG2vXnR` for login verification, then tell me if delivery succeeded.

OTP sent successfully to the contact method associated with mask `msk_7hG2vXnR`. Delivery status: `dispatched`. The recipient address and the generated OTP are never disclosed in the response for security. The user should receive the code within 60 seconds. This operation consumed one message credit from your Authyo account balance.

This write action triggers real SMS or email delivery and deducts from your usage quota. The MCP intentionally hides the OTP and recipient to prevent accidental logging. You'll need `otp:send` scope. Always pair this with the Verify OTP tool in your authentication flow to complete the loop.

@Authyo check the last five OTP verification attempts for mask `msk_7hG2vXnR` and summarize whether the user is struggling with login.

The last five OTP verification attempts for `msk_7hG2vXnR` show: 3 failed (incorrect code), 1 expired, 1 successful. The successful attempt occurred 8 minutes ago. Pattern suggests the user may have initially mistyped the code or experienced delivery delay. Current status: authenticated. No account lockout triggered. Consider sending a confirmation email if this is unusual activity for this user.

This synthesis example combines the MCP's verification history with AI reasoning to detect friction in your auth flow. Requires `otp:read` scope to access attempt logs. The MCP does not automatically lock accounts after failed attempts—you must implement that policy in your application layer if needed.

When support needs to confirm caller identity without seeing credentials

A 6-person SaaS support team fields 40-50 inbound tickets daily, many requiring account changes. Before Authyo, agents asked customers to forward confirmation emails or read back partial credit card numbers—slow and risky. With the Verify OTP tool, an agent triggers a one-time code to the customer's registered contact, the customer reads it back, and the MCP confirms identity in under 20 seconds. The agent never sees the phone number or email, so PCI and privacy audits stay clean. This works when your support volume justifies the per-OTP cost and you already route tickets through a shared workspace. If you're fielding fewer than 10 identity checks per week, the API-key setup overhead outweighs the time saved.

Revoking stale sessions in a multi-tenant product

A 3-engineer team runs a B2B dashboard with 200 active organizations. Their compliance officer mandates that sessions older than 30 days must be revoked, but manual audits miss stragglers. They schedule a weekly Switchy workflow that queries their session table, filters expired JWTs, and calls Revoke Session in batch. The MCP handles the Authyo API handshake, so the engineer writing the workflow never touches session tokens directly. This pattern works when you have predictable session-hygiene rules and a small enough user base that batch revocation finishes in under 5 minutes. If you're revoking thousands of sessions per run, you'll want a dedicated background job instead of an MCP call.

Triggering order confirmations from a shared sales workflow

A 4-person e-commerce ops team closes 15-20 custom orders weekly, each requiring a templated confirmation email with invoice details. They used to copy-paste into Gmail, which led to typos and missed sends. Now they run a Switchy workflow that reads the order record, populates the Authyo template via Send Order Notification, and logs the delivery timestamp. The MCP never exposes the customer's email in the workspace, so junior ops staff can trigger sends without seeing PII. This setup pays off when your order volume is high enough to justify the per-send billing but low enough that a human still reviews each transaction. If you're shipping hundreds of orders daily, a direct Authyo integration in your checkout flow is faster.