#1. We wish. We use around 14 different cellphone # to bypass Spam etc on SMS. Most people don't understand how hard is to reliably send SMS internationally (twilio makes it look easy in the US :))

2. Auth's are times you call the verify/token API. Since it's an API you can decide when exactly when to call it. Most our clients authenticate tokens every 14 - 30 days. So people can authentication to your app via username - password or cookies and then sometimes via username - password - token. We only count an Auth when they do username - password - token.