OAuth Verify
Add KEYRA as passwordless authentication for your website or app — then validate the result on your backend before creating a session.
On this page
What is OAuth Verify?
OAuth Verify is KEYRA's PKCE authorization-code flow for passwordless user verification. The browser starts the flow with a publishable client id (cp_*). KEYRA hosts verification. Your backend must call POST /verify/validate before trusting the user.
BROWSER YOUR BACKEND KEYRA USER
│ │ │ │
│ Start (publishable cp_*) │ │ │
├────────────────────────────────────────────────►│ │
│ authorize_url │ │ │
│◄────────────────────────────────────────────────┤ │
│ Open popup/redirect │ │ │
│ │ │◄─── verify ────────┤
│ authorization code │ │ │
│◄────────────────────────────────────────────────┤ │
│ Token exchange (PKCE) │ │ │
├────────────────────────────────────────────────►│ │
│ access_token │ │ │
│ (= verification_token) │ │ │
│◄────────────────────────────────────────────────┤ │
│ POST token to backend │ │ │
├─────────────────────────►│ │ │
│ │ POST /verify/validate│ │
│ ├─────────────────────►│ │
│ │ valid + user │ │
│ │◄─────────────────────┤ │
│ │ Create YOUR session │ │
│ Set app session cookie │ │ │
│◄─────────────────────────┤ │ │When should I use OAuth Verify?
- You want KEYRA as the primary (or primary-adjacent) passwordless login experience.
- You can register an exact callback / redirect URI for your app.
- You have a backend that can validate the verification token.
If you already authenticate users and only need step-up 2FA, use Partner 2FA instead — see Choose your integration.
OAuth Verify vs Partner 2FA
| OAuth Verify | Partner 2FA | |
|---|---|---|
| Primary purpose | Passwordless KEYRA authentication | Step-up verification on existing login |
| Existing login required? | No | Yes |
| Browser integration | Paste script or @keyra/web-sdk | QR UI only; APIs stay on server |
| Browser credentials | Publishable cp_* only | None (secrets server-side) |
| Backend required | Yes — /verify/validate before session | Yes — Partner secret APIs + consume |
| Recommended for | New KEYRA login experiences | Adding KEYRA to existing auth |
Three integration levels
Fastest
Paste Script
Load keyra-oauth.js, render a button, send the token to your backend.
Recommended SPA
Web SDK + backend
@keyra/web-sdk for popup/redirect + validateVerification on the server.
Advanced
Server SDK / REST
Drive /verify/start, token exchange, and validate yourself (or via REST).