Security verification

When authenticated users attempt sensitive or high-risk actions—such as changing their password, making a payment, or accessing sensitive information like paychecks or bank account details—additional security measures are essential. This flow is especially critical in sensitive applications like banking, healthcare, and government services.

This process, known as security verification, requires users to re-verify their identity to confirm they are the authorized account holder. By implementing security verification, the system reinforces protection against unauthorized access, adding a critical layer of security for high-risk actions and helping safeguard sensitive data.

Prefer OIDC step-up authentication for applications and APIs:

To enforce recent authentication or MFA for your own applications and protected API resources—or to authorize sensitive Account API calls using standard tokens—use OIDC step-up authentication (acr_values, max_age, and RFC 9470 challenges).

Use the Verification API below when your first-party application calls the Account API directly with a logto-verification-id header, or when you need to prove ownership of a new email address or phone number before binding it to the account.

Implement security verification by Account API

note:

Remember to enable Account API first, and get the access_token for the user.

Password verification

When users attempt to change their password or another security setting through a direct Account API integration, prompt them to enter their current password to obtain a 10-minute verificationRecordId for the logto-verification-id header.

method	path	description
POST	/api/verifications/password	Verify current user password.

Email/SMS one-time code verification

Send a verification code to the user’s email or phone number and prompt them to enter the code to confirm their identity. These endpoints can be used to verify a user’s identity or to confirm ownership of a specific email or phone number. This verification step is highly recommended when a user attempts to link a new email address or phone number to their account, ensuring the authenticity of the information provided.

method	path	description
POST	/api/verifications/verification-code	Send email or phone number verification code.
POST	/api/verifications/verification-code/verify	Verify email or phone number by verification code.