Go to developer

Partner 2FA

KEYRA Partner 2FA adds step-up verification to an application that already identifies its users.

On this page

What is Partner 2FA?

Partner 2FA is for applications that already authenticate users (email/password, SSO, magic link, etc.) and need KEYRA as an additional verification factor before creating or elevating an application session.

Your backend keeps secret credentials and drives the KEYRA APIs. Your login UI displays enrollment or challenge QR codes. The user completes verification on their device. Your backend consumes the verified result, then creates your session.

When to use Partner 2FA

Existing Application

Email + Password (or your primary auth)
       ↓
Primary authentication succeeds
       ↓
KEYRA Partner 2FA (enrollment once, then challenges)
       ↓
User verifies on device
       ↓
Your backend consumes verification
       ↓
Application session
Typical placement after your primary login succeeds
  • You already have a stable user identifier in your system.
  • You want step-up / second-factor verification without replacing primary login.
  • You can run secret API calls from a trusted server.

When NOT to use Partner 2FA

If you want KEYRA as the primary passwordless authentication experience (hosted login / paste script / web SDK), use OAuth Verify instead.

What you build

  1. Enrollment — once per user: bind your externalUserId to KEYRA.
  2. Authentication challenges — on login/step-up: create a challenge, show QR, wait for approval.
  3. Consume — exchange the one-time verificationToken for a trusted result, then create your app session.
YOUR LOGIN UI       YOUR BACKEND          KEYRA              USER DEVICE
     │                    │                  │                     │
     │ Credentials        │                  │                     │
     ├───────────────────►│                  │                     │
     │                    │ get2FAStatus     │                     │
     │                    ├─────────────────►│                     │
     │                    │ enrolled: true   │                     │
     │                    │◄─────────────────┤                     │
     │                    │ startAuthentication                    │
     │                    ├─────────────────►│                     │
     │                    │ challengeUrl     │                     │
     │                    │◄─────────────────┤                     │
     │ Show QR            │                  │                     │
     │◄───────────────────┤                  │                     │
     │                    │                  │◄──── open/scan ─────┤
     │                    │                  │──── user verifies ──►│
     │                    │ waitForChallengeApproval               │
     │                    ├─────────────────►│                     │
     │                    │ approved + token │                     │
     │                    │◄─────────────────┤                     │
     │                    │ consumeChallenge │                     │
     │                    ├─────────────────►│                     │
     │                    │ consumed: true   │                     │
     │                    │◄─────────────────┤                     │
     │                    │ Create YOUR app session                │
     │ Authenticated      │                  │                     │
     │◄───────────────────┤                  │                     │
End-to-end challenge path (enrolled user)

Where to start

New to KEYRA credentials? Read API Keys & Credentials first, then follow the Quickstart.

Prefer experimenting live? Open the Partner 2FA Playground.