question

You can create a public app to allow users to login the app using 3-legged authorization or JWT. There are pros and cons with each auth methods. And each method requires different implementation on your side. For both methods, you should keep the app client id and client secret on your server side!

- 3-Legged authorization: you will provide a login page and after a user (the one who own the phone number for sending SMS messages) logs in, you will keep the tokens and handle auto refresh to keep the access token always valid (1 hour) until if the user logs out.

- JWT: you will provide a login page with some instruction and the app client id. A user (the one who own the phone number for sending SMS messages) will copy the app client id and follow the instructions to login their own RingCentral developer portal to generate a JWT for your app. Then on your login page, let them submit the JWT token to your server. Then you will store the JWT token on your database (together with any other user data) and use the JWT token to get the access token when you need to send SMS messages for that customer. You don't need to implement the auto refresh feature, but you should not use the JWT token to get an access token every time you send a text message (otherwise, you will hit the auth rate limit 5 calls/minute). Instead, keep the tokens object and check the access token expiration time, if the access token is still valid (for 1 hour), use it, if it expires, check if the refresh token is still valid (for 7 days). If the refresh token is still valid, use it to refresh and get a new access token (also new refresh token). If the refresh token also expires, use the JWT token to get a new token.