Choose Your Integration | KEYRA Developers

On this page

What are you building?

Primary · OAuth Verify

Start hosted KEYRA passwordless authentication in the browser, then validate the result on your server.

Partner 2FA

Keep username/email authentication. Enroll KEYRA as a second factor and run step-up approval at sign-in.

What it does: Starts KEYRA passwordless authentication (PKCE + authorization code), then validates the result on your server.
When to use it: You want KEYRA as the primary authentication experience (hosted login / paste script / web SDK).
Where verification happens: KEYRA hosted verification UI; your backend validates tokens / verify responses.
Required backend? Yes for secure validation. Browser starts the flow with publishable credentials only.
Recommended SDK: Browser @keyra/web-sdk or paste script https://auth.keyra.ie/sdk/keyra-oauth.js; server @keyra/typescript-sdk / Java server helpers.

What it does: Enrolls a KEYRA verification factor for your existing users and runs step-up approval (challenge) at login.
When to use it: You already authenticate users and need stronger second-factor verification.
Where verification happens: User device (challenge approval); your backend drives enrollment/auth APIs.
Required backend? Yes — secret credentials must stay server-side.
Recommended SDK: @keyra/typescript-sdk or ie.keyra:keyra-java-sdk. Browser partner flows use @keyra/web-sdk only through a backend proxy (no secrets in the browser).

Question	OAuth Verify	Partner 2FA
Existing authentication?	Optional — KEYRA can be primary	Yes — keep it
Browser involvement	Starts hosted verify with `cp_*`	Challenge UI only (no secrets)
Backend responsibility	Validate result / tokens + create session	Drive enroll/auth APIs + consume result
Secrets in browser?	Never	Never
Primary credentials	Publishable `clientId` (`cp_*`) in browser; server validation	`projectId` + secret `clientId`/`clientSecret`
Recommended use	Passwordless primary auth	Step-up / second factor
SDKs	`@keyra/web-sdk` + server SDK / paste script	`@keyra/typescript-sdk`, Java, Web via proxy
API host	`https://auth.keyra.ie`