Authentication guide
Use case
Attach device context to a login attempt
Collect immediately before credential submission or after an identity-provider callback, using an opaque login_attempt ID created by the backend.
Event flow
The action ID binds a short-lived collection to one authentication attempt. It is not a device identifier and should expire with the login flow.
Mobile collection
Before authentication, omit clientId. The backend already knows the attempted username or identity-provider subject and must not trust an account identifier supplied by the device as authentication.
import { consentFor, DeviceIntel } from "react-native-device-risk-signals";
const loginIntel = new DeviceIntel({
consent: consentFor([
"device_identity",
"application",
"os_integrity",
"device_security_posture",
"network",
"locale",
"runtime",
]),
});
const observations = await loginIntel.collect({
sessionId: loginAttempt.id,
});
await api.post("/api/v1/device-signal-events", {
action_id: loginAttempt.id,
action_type: "login_attempt",
sdk_version: SDK_VERSION,
platform: Platform.OS,
observations,
});After authentication succeeds, applications may call setClientId(accountId) for later events. That value remains app-supplied correlation data, not identity proof.
Backend request
POST /api/v1/device-signal-events
Authorization: Bearer <login-flow-token>
Idempotency-Key: <unique-event-key>
{
"action_id": "login_01JEXAMPLE",
"action_type": "login_attempt",
"sdk_version": "0.8.1",
"platform": "ios",
"observations": { "...RawSignalEvent": "..." }
}Validate ownership, expiry, timestamp freshness, request size, and idempotency. Store the unmodified event and derive adopted features separately.
How the backend can use it
Join, do not replace
Join raw observations with credential result, rate limits, account history, session history, and server-side network context.
Preserve missing states
A timeout, unavailable permission, omitted field, and observed false mean different things.
Calibrate outcomes
Measure false-positive and missing-data rates on representative physical devices before adopting a field in policy.