Protect logins

Login checks protect your existing users. isCredible compares each login with that user's own history, so a login from a device or country the account has never used stands out.

When to call#

After the password check succeeds, and before sensitive actions such as changing the password or email, adding a payment method or creating an API key.

const result = await iscredible.verify({
  userId: user.id,                  // required for per-user history
  email: user.email,
  ip: req.ip,
  deviceId: body.deviceId,
  geoLocation: { latitude, longitude, country }, // if you have it
  loginAttempts: failedAttemptsBeforeThisLogin,
  passwordChanged: false,
  sensitiveActionPerformed: false
});

Suggested handling#

• APPROVE: continue.
• REVIEW: ask for a second factor, or email the user a confirmation link.
• DENY: block the session, notify the account owner and ask them to reset their password.