Login Step-Up Verification
A 3-step recipe with Sift. We can help you get access.
Recipe · 3 steps
Login Step-Up Verification
with Sift
Submit a login event, branch on the ATO score, and run a verification challenge.
- Submit a $login event with return_score=true so Sift scores the login for account takeover synchronously.
- Dispatch a verification challenge to the user through the requested channel, tying it to the parent $login event.
- Validate the code the user entered against the active verification challenge.
What you'll need to have ready
- apiKey: Sift account API key sent in the event body as $api_key.
- userId: The user's unique identifier ($user_id).
- sessionId: Optional session identifier for the login.
- ip: Optional originating IP address for the login.
- sendTo: Phone number or email to send the verification challenge to.
- verificationType: Verification channel to use ($sms, $email, $phone, $face, $fingerprint, $push, $security_key).
- brandName: Optional brand name shown in the verification message.
- verificationCode: The code the user entered, submitted for validation.
- abuseTypes: Comma-separated abuse types to score the login on.
- scoreThreshold: ATO score (0-100) at or above which step-up verification is required.
For your developer
Arazzo workflow sift-com:login-step-up-verification, 3 operations: sendEvent → sendVerification → checkVerification. Specs on APIs.io.