Authentication guide

Use case

Attach device context to a login attempt

Collect immediately before credential submission or after an identity-provider callback, using an opaque login_attempt ID created by the backend.

Event flow

1. Create login attempt
2. Return action ID
3. Collect locally
4. Submit through host API
5. Join server evidence

The action ID binds a short-lived collection to one authentication attempt. It is not a device identifier and should expire with the login flow.

Mobile collection

Before authentication, omit clientId. The backend already knows the attempted username or identity-provider subject and must not trust an account identifier supplied by the device as authentication.

import { consentFor, DeviceIntel } from "react-native-device-risk-signals";

const loginIntel = new DeviceIntel({
  consent: consentFor([
    "device_identity",
    "application",
    "os_integrity",
    "device_security_posture",
    "network",
    "locale",
    "runtime",
  ]),
});

const observations = await loginIntel.collect({
  sessionId: loginAttempt.id,
});

await api.post("/api/v1/device-signal-events", {
  action_id: loginAttempt.id,
  action_type: "login_attempt",
  sdk_version: SDK_VERSION,
  platform: Platform.OS,
  observations,
});

After authentication succeeds, applications may call setClientId(accountId) for later events. That value remains app-supplied correlation data, not identity proof.

Backend request

POST /api/v1/device-signal-events
Authorization: Bearer <login-flow-token>
Idempotency-Key: <unique-event-key>

{
  "action_id": "login_01JEXAMPLE",
  "action_type": "login_attempt",
  "sdk_version": "0.8.1",
  "platform": "ios",
  "observations": { "...RawSignalEvent": "..." }
}

Validate ownership, expiry, timestamp freshness, request size, and idempotency. Store the unmodified event and derive adopted features separately.

How the backend can use it

Join, do not replace

Join raw observations with credential result, rate limits, account history, session history, and server-side network context.

Preserve missing states

A timeout, unavailable permission, omitted field, and observed false mean different things.

Calibrate outcomes

Measure false-positive and missing-data rates on representative physical devices before adopting a field in policy.

Decision boundaries

The SDK does not calculate a risk score or authenticate the user. Never decline a login from one root, emulator, VPN, debugger, or locale observation. Keep step-up and account recovery paths available.