Your apps

Each app gets its own public and secret key.

API keys

API URL

Public key

Secret key

Shown only once, when created or rotated. Keep it on your server.

AI integration prompt

Paste this into your AI coding assistant (Claude, ChatGPT, Copilot, Cursor…) to have it add AdaptiveAuth to your project. It includes this app's API URL and public key.

Your app's client

Your backend

The prompt never contains your secret key. Put it in your server's environment as ADAPTIVE_AUTH_SECRET_KEY: don't paste secrets into AI chats.

Settings

Recent activity

Sessions

Created	Status	Method	Attempts

Audit log

Time	Event	Details

Danger zone

Deleting the app revokes both keys and removes its users, enrolled factors and history.

Quicklook

See exactly what your users see. This is the real widget from the SDK, running locally: nothing is sent to your apps or counted in your activity.

Moment

Second factor

Quickstart

Three calls: your server asks for a decision, the user passes the step-up in the browser, your server verifies the result.

How it works

After the password check, your server calls /create-session with the user id and location.
The answer is allow (log them in), enroll_required (first time: they set up a factor) or step_up (unusual location: they must verify).
For enroll/step-up, your web page shows the AdaptiveAuth widget with the sessionId. On success it gives you a short-lived token.
Your server sends that token to /verify-token. Only log the user in if it returns ok: true. Each token works once.

Sign in

Choose a new password

Your apps

No apps yet