Mobile devices are authorized to access PBX-based voice services through presentation of audible tones on a voice channel, which are determined based on a code received over a separate data channel. The device can request a code over a data channel from a server in communication with the PBX. The server provides data representative of the code over the data channel to the device, and arranges for local storage of the code. The device makes a connection with the PBX over a separate voice channel. The mobile device presents the received code as a sequence of audio tones (e.g., DTMF tones). The audio tones are used to generate data that can be compared with stored codes by an authentication module. The authorization module can indicate to the PBX that the code is valid; services can be provided by the PBX in response. The valid codes can be maintained, such as by removing used codes from code storage.