Skip to main content

​
The idea is simple

For your users — easy authentication: scanning a QR code or tapping a single button is all it takes to sign in to your app or website. Even a user’s first sign-in takes only 4–6 seconds. See the measurements. For your website or app: set up in 15–30 minutes on any stack and get the user’s details straight from their messaging app — name, language, photo and, with their consent, phone number. Another benefit: at sign-in your website automatically gets a live channel to the user through their messaging app, and you stop paying for SMS.

​
How it works

On a computer, a TV or a kiosk, your user scans the QR code on the sign-in page; on a phone they tap a button. The messaging app they already use opens — Telegram, WhatsApp or another popular one — and the user confirms the sign-in with a single tap there.
You can also use Veriqa to confirm AI agent actions and sensitive operations: deleting important data, changing payment details, granting access to another person. Try the live examples.
More videos · Try the live examples The code is open source under MPL-2.0 and free for companies of any size.

​
What you get

Add sign-in with a messaging app to your website, next to the sign-in methods you already have. You get less friction at sign-in, lower costs, stronger security and a live connection with the user. Setting up Veriqa takes 15–30 minutes and costs nothing, and your users get a quick and convenient way to authenticate on your website or in your app.

​
For your users

Nothing to type

No password, no SMS code, no sign-up form. Scanning a QR code or tapping a button, then confirming in the messaging app, is all it takes.

Nothing to install or remember

The messaging app is already on their phone. No new app, no authenticator app and no password to forget and recover.

The same on any device

On a computer, a TV or a kiosk it is a QR code; on a phone, a button. The confirmation is always the same tap in the messaging app.

​
For your product

Higher sign-in conversion

Instead of a password, an SMS code and switching between screens — one familiar action: opening the camera on the phone. Sign-in or sign-up takes 4–6 seconds, and that is the whole path: pointing the camera, tapping the link and confirming in the messaging app.

Savings on every sign-in

SMS is billed per message. Sign-in and confirmation via Veriqa aren’t billed per message: in WhatsApp, Veriqa replies to the user’s message without a template, and under Meta’s current pricing such replies are free. Veriqa itself is open source.

A live channel instead of a “dead” address

Along with the sign-in, your product gets a connected messaging channel — for notifications, confirmations and future service use cases.

Configuration-only integration

Nothing for the user to install and no new client-side code — Veriqa plugs into your existing app through configuration.

Account recovery

“Forgot password” is no longer an ordeal: a linked trusted channel becomes a reliable recovery path, without a chain of emails and codes.

Resilience to a personal-data leak

Veriqa stores the bare minimum: the identifier that each messaging app assigns to the user. No names, no phone numbers. The data a sign-in needs appears only during the sign-in and can be kept in memory only. In the next release you will be able to store a pseudonym instead of the identifier itself.

​
Get started

Start with the quickstart: the Veriqa server in a container and sign-in for your app on any stack.

​
Use cases

Examples of how Veriqa handles everyday tasks for websites and apps.

Passwordless authentication

Your website or app shows a QR code, and the user confirms the sign-in in their messaging app — no password needed. A new user signs up with the same action, with no form and no CAPTCHA: the confirmation in the app itself acts as the bot barrier.Learn more · Video

AI agents: a human approves the risky step

Before an AI agent calls a tool or receives access, it asks a human for approval. The request arrives in the user’s own messaging app — a surface the agent does not control — and the answer goes into the audit trail.Learn more · Video

A direct channel to the user

The user signs in through a messaging app, and with the same action your product gets a live channel to them — Telegram, WhatsApp, another channel or email, depending on where they confirmed. One action, two results: you can use the channel for notifications and service messages.Learn more

Replacing SMS codes

Instead of typing a code from an SMS, the user confirms the sign-in with a button in their messaging app. You pay no per-message charge and get full authentication rather than just a delivered code.Learn more · Video

Leads and feedback without CAPTCHA

Before submitting a form, a visitor verifies themselves through a messaging app — it takes a few seconds. Your site gets a verified contact and a live channel instead of a “dead” address typed into a field. Tested and working on WordPress, Bitrix, Drupal, Joomla, TYPO3 and other CMSs.Learn more

Second factor, step-up and action confirmations

When a user does something sensitive — deletes important data, changes payment details, grants someone else access — your product asks them to confirm it. They confirm with a single tap in their messaging app, with no code to type.Learn more · Video
There is more: sign-in on surfaces with no keyboard and account recovery; the overview is in Integration scenarios. Basic scenarios shows which of the two basic mechanisms — sign-in or the server-to-server transaction — each one uses.

​
Sign-in methods compared

The Veriqa times are for a sign-in with confirmation; with automatic sign-in it takes 2.4–3.5 s. The source of every figure, what the user does step by step and how the setup was assessed are in the full comparison. How Veriqa fundamentally differs from passkeys, sign-in widgets built into messaging apps, SMS codes and the device flow is covered separately.

​
Architecture

Veriqa is a bridge between your application and the user’s trusted messaging app. It opens a sign-in or confirmation transaction, binds it to the chosen channel, waits for the user’s confirmation and hands the result back — as tokens for the sign-in, or as an outcome to your backend. What Veriqa is made of, block by block, and its main technical characteristics:
  1. Transaction orchestration. A sign-in is a transaction with an explicit state, a lifetime and a single outcome. It survives a change of device, expires on its own, handles repeated requests idempotently and lands in the audit trail — instead of a request left hanging somewhere between the browser and the messaging app.
  2. Channel adapters. Telegram, WhatsApp, Email and others are switched on by configuration. A channel of your own needs no change to the core, and it does not have to be .NET: an external service in any language over HTTP, or the bot you already run, as is. Your channels take their place in the chain alongside the built-in ones.
  3. Integration. Any stack, standard OIDC. On .NET — a connector on top of OpenIddict. Everywhere else — a standard OIDC provider: Node, Java, Python, Go, PHP. In an IAM such as Logto it is added as an ordinary social connector.
  4. Settings and multi-project support. Tokens, channels, the texts and branding of the sign-in page, policies, limits, the audit trail — all of it is configuration, with four levels of ownership, including the core, the tenant and the application, and a defined resolution order. One installation serves many projects and bots, each with its own settings.
  5. Audit trail and observability. The audit trail is off by default; you switch it on and set its rules. Identities are always masked, and tokens are written neither to the log nor to the audit trail — that is how it is built, not a setting you have to remember. Metrics, logs and traces work the same way: they carry no tokens and no personal data.
  6. Stack. .NET 10, shipped as NuGet packages that plug into a running application. Clean architecture; storage in memory, EF Core (PostgreSQL, SQL Server and others) or Redis. The sign-in page is plain JS — no frameworks, no external dependencies. The data does not leave your perimeter.
Details are in Architecture.

​
Deployment

Veriqa Cloud is in development; its API contract is described in Cloud.
A note on .NET. In embedded mode Veriqa extends the OpenIddict setup in your ASP.NET Core application rather than replacing it: it runs the sign-in transaction between /connect/authorize and /connect/token and leaves token issuance to OpenIddict. On any other stack OpenIddict is not involved at all — the application talks to Veriqa over plain OpenID Connect.

​
Channels

Eight channels are built into the core, including Telegram, WhatsApp (direct or through Twilio), Instagram, Messenger, WeChat, Viber and Email. Any other channel — a corporate messaging app, a bot of your own, a regional platform — connects as an HTTP channel written in any language. Pseudo-channels for sign-in with Google, Apple and Huawei accounts ship as a sample in the repository. Adapters for LINE, Slack, Microsoft Teams, Discord, Zalo, KakaoTalk, Threema and more are already implemented — they live in the channel-adapters repository, together with sample hosts (see the source code). The full list, with the status of each channel, is on the website’s channels page and in Supported channels.