diff --git a/build.gradle b/build.gradle
index 8a92acf..b9de6ad 100644
--- a/build.gradle
+++ b/build.gradle
@@ -60,6 +60,9 @@ dependencies {
     // JSON
     compile 'com.google.code.gson:gson:2.8.1'
 
+    // Phone numbers validation
+    compile 'com.googlecode.libphonenumber:libphonenumber:8.7.1'
+
     testCompile 'junit:junit:4.12'
 }
 
diff --git a/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy b/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy
index a397e53..c70d203 100644
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/SessionController.groovy
@@ -25,7 +25,6 @@ import com.google.gson.JsonObject
 import io.kamax.mxisd.controller.v1.io.SessionEmailTokenRequestJson
 import io.kamax.mxisd.controller.v1.io.SessionPhoneTokenRequestJson
 import io.kamax.mxisd.exception.BadRequestException
-import io.kamax.mxisd.exception.NotImplementedException
 import io.kamax.mxisd.lookup.ThreePid
 import io.kamax.mxisd.mapping.MappingManager
 import org.apache.commons.io.IOUtils
@@ -79,10 +78,14 @@ class SessionController {
     }
 
     @RequestMapping(value = "/_matrix/identity/api/v1/validate/{medium}/submitToken")
-    String validate(HttpServletRequest request) {
+    String validate(HttpServletRequest request,
+                    @RequestParam String sid,
+                    @RequestParam("client_secret") String secret, @RequestParam String token) {
         log.info("Requested: {}?{}", request.getRequestURL(), request.getQueryString())
 
-        throw new NotImplementedException()
+        mgr.validate(sid, secret, token)
+
+        return "{}"
     }
 
     @RequestMapping(value = "/_matrix/identity/api/v1/3pid/getValidated3pid")
@@ -123,7 +126,7 @@ class SessionController {
         } catch (BadRequestException e) {
             log.info("requested session was not validated")
 
-            obj = new JsonObject()
+            JsonObject obj = new JsonObject()
             obj.addProperty("errcode", "M_SESSION_NOT_VALIDATED")
             obj.addProperty("error", e.getMessage())
             response.setStatus(HttpStatus.SC_BAD_REQUEST)
diff --git a/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java b/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java
index 116daab..ebf728f 100644
--- a/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java
+++ b/src/main/groovy/io/kamax/mxisd/controller/v1/io/SessionPhoneTokenRequestJson.java
@@ -1,22 +1,29 @@
 package io.kamax.mxisd.controller.v1.io;
 
+import com.google.i18n.phonenumbers.NumberParseException;
+import com.google.i18n.phonenumbers.PhoneNumberUtil;
+import com.google.i18n.phonenumbers.Phonenumber;
+
 public class SessionPhoneTokenRequestJson extends GenericTokenRequestJson {
 
+    private static PhoneNumberUtil phoneUtil = PhoneNumberUtil.getInstance();
+
     private String country;
     private String phone_number;
 
     @Override
     public String getMedium() {
-        return "email";
+        return "msisdn";
     }
 
     @Override
     public String getValue() {
-        return phone_number;
-    }
-
-    public String getCountry() {
-        return country;
+        try {
+            Phonenumber.PhoneNumber num = phoneUtil.parse(phone_number, country);
+            return phoneUtil.format(num, PhoneNumberUtil.PhoneNumberFormat.E164).replace("+", "");
+        } catch (NumberParseException e) {
+            throw new IllegalArgumentException("Invalid phone number");
+        }
     }
 
 }
diff --git a/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java b/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java
index fe760e3..1b929e9 100644
--- a/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java
+++ b/src/main/groovy/io/kamax/mxisd/mapping/MappingManager.java
@@ -60,6 +60,18 @@ public class MappingManager {
         return sid;
     }
 
+    public void validate(String sid, String secret, String token) {
+        Session s = sessions.get(sid);
+        if (s == null || !StringUtils.equals(s.secret, secret)) {
+            throw new BadRequestException("sid or secret are not valid");
+        }
+
+        // TODO actually check token
+
+        s.isValidated = true;
+        s.validationTimestamp = Instant.now();
+    }
+
     public Optional<ThreePid> getValidated(String sid, String secret) {
         Session s = sessions.get(sid);
         if (s != null && StringUtils.equals(s.secret, secret)) {