Which one to choose
Both Veriqa mechanisms fit. They differ in what the user sees and where the confirmation starts.
How to choose. If the message has to name the operation itself — the amount, the payee, the new
address — or the action does not start in the user’s browser, use the server-to-server confirmation
API. If you only need to make sure the user is at the screen right now, step-up is enough.
What you need
- a Veriqa server with a channel enabled and an app connected to it — for example, by the Passwordless sign-in for a web app recipe;
- access to the backend that performs the operation.
Steps: step-up
1
Send a new authorize request before the action
A regular sign-in request with no special parameters — What you send.
2
Check auth_time
Perform the operation only if the
auth_time in the new id_token is within your freshness
window — What you check.3
Narrow the channel if needed
The
acr_values parameter sends the confirmation to a specific channel —
Going stronger: two different channels.Steps: server-to-server confirmation API
1
Declare the action type
In the client record, describe the action type: its slots and the message text —
Configure the client.
2
Create the confirmation
The backend gets a token with client credentials and calls
POST /api/transaction/confirmation,
passing the account owner’s identity in expected_identities —
steps 2–3.3
Show the QR code or the link
Display the
channel_entry from the response on the user’s screen —
Create the confirmation.4
Wait for the outcome
Poll
GET /api/transaction/{id}/result and perform the operation on confirmed with a matching
matched_type — Read the outcome.How to check
Start the operation and confirm it on your phone — the operation should run. Then repeat and decline the confirmation: the operation should not run. For the server-to-server confirmation API, also confirm from another account:matched_type in the result should stay null.
Next steps
- Step-up, second factor, human-in-the-loop — three working samples built on the server-to-server confirmation API, including a project deletion that only the owner can confirm;
- Approving AI-agent actions — the same API for an agent’s steps;
- Basic scenarios — when you need a sign-in and when a server-to-server transaction.