> **Warning:** This Epic's description is managed as documentation and mirrors a file in the > website repository. Do not edit it directly. See [how we manage the roadmap](https://selorahomes.com/handbook/departments/product/roadmap-management/) > and propose all content changes via a Merge Request. [📝 Source](https://gitlab.com/selorahomes/products/selorahomes.com/-/blob/main/content/docs/roadmap/support-access-requests-validation/index.md) ## Overview When an installer or the Selora Homes support team needs remote access to a homeowner's Home Assistant installation, they submit an access request through Selora Connect. Today, the homeowner receives an **email** and has to **log in to their Selora Connect dashboard** to approve or deny the request. This feature adds SMS as a first-class validation channel: homeowners receive the request by text message and can approve, deny, or revoke access with a single reply — no email inbox, no app, no login. The existing email and dashboard flow continues to work in parallel as a fallback for homeowners who prefer it. ## Today vs. with SMS validation | Step | Today | With SMS validation | | ---- | ----- | ------------------- | | Notification | Email | SMS (email fallback if delivery fails) | | Approve or deny | Log in to Selora Connect | Reply `APPROVE` or `DENY` | | Revoke an active session | Log in to Selora Connect | Reply `REVOKE` | | Session events | Dashboard only | SMS at start, 5 minutes remaining, and end | | Audit trail | Dashboard | Dashboard, plus `HISTORY` by SMS | The request form, session mechanics (temporary user account, double authentication, time-boxed duration, extensions), and audit logging all work exactly as today. This item only changes **how the homeowner is notified and how they respond**. ## Workflow ### 1. Request (unchanged) The installer or support team requests temporary remote access through the Selora Connect installer dashboard, specifying: - **Why**: Reason for access (e.g., troubleshooting, configuration, firmware update) - **How long**: Requested duration (e.g., 30 minutes, 1 hour) ### 2. SMS notification (new) Instead of email only, the homeowner receives a text message with: - Installer name and company - Request reason - Requested duration - Timestamp of the request - The two available replies: approve or deny Example SMS: ```text Selora Homes: Installer John D. from BrightTech Solutions requests remote access to your Home Assistant installation to troubleshoot lighting control. Duration: 30 min. Reply APPROVE or DENY to confirm. ``` ### 3. Decision via SMS reply (new) The homeowner responds by text — no app or login required: - Reply `APPROVE` to grant access (optional duration modifier, e.g. `APPROVE 1 hour`) - Reply `DENY` to reject the request (optional reason, e.g. `DENY — busy now`); the installer is notified - No response: the request expires after a configurable timeout (default 15 minutes) and the installer is notified Homeowners who use the Selora Connect dashboard instead can approve or deny there, exactly as today. ### 4. Session execution (unchanged, plus SMS events) Once approved, the session runs as it does today — temporary user account, double authentication, time-boxed duration. New: the homeowner receives SMS notifications at key session moments: - When the session starts: `Access started by John D.` - When 5 minutes remain: `5 minutes remaining in access session` - When the session ends: `Access session completed` ### 5. Immediate revocation (new via SMS) The homeowner can terminate any active session at any time with one SMS: - Reply `REVOKE` to end the session immediately - Installer receives: `Access revoked by homeowner — session ended at [time]` - The session is logged in the access history with status `revoked` ### 6. Logging and audit trail (unchanged, plus SMS access) Every access event continues to be recorded and visible in the Selora Connect dashboard as today. New: homeowners can retrieve recent events by replying `HISTORY` to any Selora SMS. ## SMS integration details ### Provider and configuration - Primary: Twilio SMS API (or equivalent provider) - Phone number stored per homeowner account, collected during onboarding - Fallback: email notification if SMS delivery fails (per household) ### Message formatting - Concise messages, under 160 characters where possible - Keywords: `APPROVE`, `DENY`, `REVOKE`, `HISTORY` — case-insensitive - Timezone-aware timestamps in all messages - Sender ID: "Selora" (branded sender, for recognition and searchability) ### Privacy and security - Phone numbers stored encrypted, never logged in plaintext - Each SMS includes the request ID for audit-trail correlation - No credentials or sensitive data in SMS content - Homeowners can opt out of SMS at any time and fall back to email ### Delivery guarantees - Retries up to 3 times at 2-minute intervals - Delivery confirmation logged - Homeowner notified if a message failed to deliver ## Dashboard integration SMS is the fast path; the Selora Connect dashboard remains the system of record and continues to provide: - Complete access history with all events - Active session monitoring (duration, remaining time) - Request submission for installers and extension requests - Approve/deny as an alternative to SMS - Access log export for compliance ## Customer value ### For homeowners - **Full control without a login**: approve, deny, or revoke from any phone - **Immediate revocation**: one `REVOKE` stops an active session - **Transparency**: SMS notifications for every session event - **Fallback preserved**: email and dashboard keep working as today ### For installers - **Clearer outcomes**: SMS replies give a faster, more reliable response than waiting for a dashboard login - **Same workflow**: request form, session mechanics, and extension flow are unchanged ### For the support team - **Compliance**: full audit trail of every access event, as today - **Security**: homeowner-controlled access with explicit, logged approval ## Scope (first iteration) - SMS provider integration (Twilio or equivalent) for request notifications - Approve/deny/revoke via SMS reply with case-insensitive keywords - Automatic expiry for unresponded requests (configurable timeout) - Session-event SMS notifications (start, 5 minutes remaining, end) - `HISTORY` SMS command for recent access events - Phone number management per homeowner account with opt-out to email - Email fallback when SMS delivery fails - No changes to the request form, session mechanics, or dashboard logging ## Target customers - **Homeowners**: SMS-based access control without logging in - **Installers**: faster, more reliable homeowner responses - **Support team**: same audit trail and compliance logging ## Related - [Request Remote Support Access](https://selorahomes.com/docs/installer/selora-hub/remote-access/) — the current installer-facing request workflow this builds on - [Manage Installer Remote Access](https://selorahomes.com/docs/selora-hub/installer-remote-access-controls/) — the current homeowner-side approval flow (email + dashboard)