Integration guides

AuthenSee integrates through its co-branded hosted flow, which you launch from your own app. Your backend mints a session, the user completes the ceremony on AuthenSee's origin, and your backend exchanges a one-time result code. The guides below take you through each surface end to end.

Pick your path

Which surface should I use?

• You're a third-party web app — use the popup embed or a full redirect. The passkey ceremony must run in a top-level context on AuthenSee's origin; a cross-origin iframe can't run it, and the hosted flow refuses framing outright.
• You're building a mobile app — open the hosted flow from your app and exchange the result on your backend; see React Native.
• You need direct SDK control — the on-device SDK (enroll() / authenticate()) only works served from AuthenSee's own origin, so it's for AuthenSee's first-party surfaces. The SDK section documents it so you know exactly what runs inside the hosted flow.

Common integration patterns

The snippets below show the backend side, which is the same for every surface: trigger a flow, then exchange the result code your callback receives.

Step-up authentication

Keep your existing login and use AuthenSee for high-security actions — money transfers, account changes, deletions:

// 1. User clicks "Transfer" → your frontend opens the hosted flow
//    (popup or redirect) with a fresh authenticate-scoped session.
// 2. Your callback receives a one-time authResultCode.
// 3. Your backend exchanges it before allowing the action:
 
const result = await authensee.exchangeAuthResult(authResultCode);
 
if (result.status === 'authenticated' && result.externalUserId === req.user.id) {
  await performTransfer(req.body);
}

Account recovery

Replace email links and SMS codes with proven identity — the user re-proves their enrolled factors without revealing anything to your server:

const result = await authensee.exchangeAuthResult(authResultCode);
 
// providerSubject is your stable alias for the persona; match it against
// the account under recovery before granting access.
if (result.providerSubject === account.authenseeSubject) {
  await grantRecoverySession(account);
}

Enroll once, use everywhere

Users who already enrolled through another AuthenSee provider don't re-enroll with you — the hosted flow offers to link their existing persona instead, and your callback receives linked=1 with a providerSubject. Handle both callback shapes and you support returning users for free.

Next

• Embed guide — the fastest path to production
• Core concepts — personas, schemes, and the zero-knowledge boundary
• API reference — every endpoint behind these flows