Go to developer

Getting Started

Authentication Architecture

Understand which system owns UI, credentials, verification, and application sessions — before you copy SDK snippets.

On this page
  1. BROWSERYour AppBrowser UI
  2. SERVERYour BackendServer
  3. KEYRAKEYRAIdentity API
  4. DEVICEUser DeviceApprove / complete
Primary actors in a KEYRA integration

Actors

Every KEYRA integration has four actors. Keeping their responsibilities separate is how you avoid leaking secrets and creating untrusted sessions.

BROWSER

Browser

  • May start OAuth Verify / hosted login with publishable credentials only.
  • May render enrollment/challenge UI when your app supplies data from the backend.
  • Must never hold secret keys or call Partner 2FA secret APIs directly.
SERVER

Developer backend

  • Stores secret credentials and projectId.
  • Calls Partner 2FA APIs (createKeyraPartner2FA / Java equivalent).
  • Validates OAuth Verify results server-side before creating your application session.
  • Is the trust boundary between KEYRA proofs and your product authorization.
KEYRA

KEYRA

  • Hosts authentication APIs at https://auth.keyra.ie.
  • Issues challenges, enrollment sessions, and verification outcomes.
  • Serves hosted OAuth UI / paste script for passwordless flows.
DEVICE

User device

  • Where the user completes verification (scan/approve challenge, complete hosted verify).
  • KEYRA binds verification to the identity/enrollment your backend manages.

Browser

Owns presentation only — never secrets. Publishable credentials (cp_*) are acceptable in the browser for OAuth Verify start flows.

Developer backend

Owns credentials, Partner 2FA orchestration, and session creation after a trusted KEYRA result.

KEYRA

Owns verification infrastructure — challenges, enrollment, hosted verify UI, and cryptographic outcomes.

User device

Owns human approval. Verification completes on the device; your backend consumes the result.

OAuth Verify vs Partner 2FA

OAuth Verify

Browser start, server validate

The browser starts hosted KEYRA authentication with publishable credentials. Your backend validates the result before creating an application session.

BROWSER                 KEYRA               YOUR BACKEND
   │                       │                      │
   │ Start verify (cp_*)   │                      │
   ├──────────────────────►│                      │
   │ Hosted verification   │                      │
   │◄──────────────────────┤                      │
   │ Code / result         │                      │
   ├─────────────────────────────────────────────►│
   │                       │   Validate / token   │
   │                       │◄─────────────────────┤
   │                       │─────────────────────►│
   │                       │                      │ Create app session
OAuth Verify — browser start, server validate

Partner 2FA

Backend-driven step-up

Your backend starts enrollment and authentication. The browser only displays challenge UI. KEYRA verifies on the user device; your backend consumes the verified result.

YOUR APP BACKEND          KEYRA               USER
       │                     │                   │
       │ Start auth / enroll │                   │
       ├────────────────────►│                   │
       │ Challenge / QR data │                   │
       │◄────────────────────┤                   │
       │ Show challenge UI   │                   │
       │                     │◄── approve/scan ──┤
       │ Poll / consume      │                   │
       ├────────────────────►│                   │
       │ VERIFIED            │                   │
       │◄────────────────────┤                   │
Partner 2FA — backend-driven step-up