The Key Was Already in Your Pocket

You know the scene. A bank asks for a six-digit code. The phone has no service, the text arrives late, and by the time it does the checkout has expired. The ritual is familiar enough to feel secure. It is also a peculiar bargain: to prove you own an account, you must successfully receive and transcribe a message that an attacker may be able to steal. Glide Identity, now called Glide.id, has built a company around the suspicion that the phone already holds better evidence.

A SIM card contains a private cryptographic key provisioned by a mobile operator. Glide’s core trick is to make that key answer a challenge without revealing the key itself. The service receives proof that the expected mobile subscription is present, then passes a result to the business asking for verification. In theory, the customer need only tap or continue. There is no secret delivered in a text for a stranger to persuade them to read aloud.

A security key with a phone plan

The idea sounds obvious after somebody says it. It was anything but obvious to commercialize. A phone company controls the SIM, the network and the interface through which outside developers can ask questions. A bank controls the account. An operating system controls much of the device experience. Glide sits between all three. Its product is part authentication software, part diplomatic mission.

Founder and CEO Eran Haggiag had spent years in telecom before this venture. At ClearX, an earlier company, he worked on settlement and clearing networks for operators. In a 2026 interview, he described a previous stablecoin-based settlement effort that arrived before the regulatory environment was ready and did not scale as hoped. It left him with knowledge of how carriers buy, integrate and cooperate. When he looked for a hardware root of trust already attached to a widely used public identifier, the phone number and SIM presented themselves.

“All you need to do is just to convince a hundred telcos to implement what’s needed and contract with you.”- Eran Haggiag, founder and CEO, in a 2026 interview

The line is funny because the hard part is plain. Cryptography can be written once. Carrier relationships have to be won one by one. Glide’s public trail shows that effort: a Google Cloud Open Gateway collaboration, work with Telefónica and other operators, and a US beta announced across AT&T, T-Mobile and Verizon. The company launched MagicalAuth and SuperPasskey at Authenticate 2025, and announced a Series A of more than $20 million led by Crosspoint Capital Partners around the same time.

The code was the weak link

MagicalAuth is the simplest expression of the thesis. It is meant to replace SMS one-time passwords during registration, login or a sensitive transaction. Glide says a business can add it through REST APIs or SDKs and keep existing customer identity systems. That makes the first buyer likely to be a fraud or product team at a bank, fintech, marketplace or other service where a failed verification can mean both a stolen account and a lost customer.

SuperPasskey addresses the less glamorous part of passwordless design: recovery. A passkey can make ordinary sign-in strong, then an account recovery journey sends the user back to a texted code. Glide combines FIDO2 passkeys with carrier-backed verification and verifiable credentials so the second door is better guarded. Glide-Out extends verification to payments. Glide-In proposes tap or QR-based identity checks at hotels, events and other physical entrances. The latter products show the size of the ambition, but the publicly announced three-carrier beta is for MagicalAuth.

The pricing picture is less tidy than the technical diagram. Glide sells to businesses, and its site offers sales conversations rather than a public price sheet. The Glide-Out page describes per-user and monthly active number billing. A buyer therefore has to ask what each verified user or active number costs, what happens when a carrier cannot answer, and whether savings from fewer SMS messages, less fraud and better completion exceed the bill. A small pilot can answer more than a long promise.

The test belongs to the buyer

For a developer, there is something copyable here even without buying Glide: inspect the weakest step in an authentication journey. If the main sign-in uses passkeys but a reset uses a text, the reset deserves the same scrutiny. Measure completion time, code delivery failures, account takeovers, fallback rates and support tickets before changing the flow. Then run a controlled pilot by carrier and device, because the average can hide the people for whom verification never completes.

This approach has boundaries. It depends on carrier support and a working relationship between a phone subscription and the person or account being verified. Shared plans, changed numbers, travel, loss of service and unusual device setups require thoughtful recovery and fallback paths. A SIM can prove possession of a carrier-issued credential; it is not, by itself, a complete biography of the person holding the handset. Extra checks still matter when a transaction demands them.

Glide’s move from “Glide Identity” to “Glide.id” in July 2026 fits its widening language. The company now describes continuous verification for people and AI agents, not just a more pleasant login. That future-facing claim is interesting. The present-day achievement is more concrete: it has brought a carrier-backed method into a public US beta across the three largest operators. The number to watch next is not the billions of SIMs in existence. It is the number of real logins that finish safely, quickly and without a text.