Risky logins with
the right password

Check returning accounts for unfamiliar devices and risky login patterns before creating a session.

Decision trace

How it works

1. Identify the login

   Verify a browser token with a login action and your trusted account id.

2. Compare history

   Check known device hashes, the last allowed country and time, and account-attempt velocity.

3. Gate the session

   Your backend checks the password and only creates a session after an allow or verified step-up.

API

Use the normal verification endpoint. Keep the secret server-side.

POST https://nolgard.com/v1/verify
Content-Type: application/json

{
  "secret": "SITE_SECRET",
  "token": "BROWSER_TOKEN",
  "action": "login",
  "account": { "id": "user_42" }
}

// Example response fields
{
  "success": true,
  "decision": "challenge",
  "ref": "ev_123",
  "login": {
    "knownDevices": 2,
    "newDevice": true
  }
}

Limits

• Default actions: login, signin and sign_in. Matching is exact; an empty configured list disables login checks.
• Device memberships cover 90 days and count visitor/fingerprint hashes, never physical hardware. A first login has no new_device reason.
• A new device alone does not challenge. A new device plus a suspicious verdict does. Other login reasons can challenge without it.
• impossible_travel means a different country within two hours; no distance is calculated. stale_account means no known device and a last allowed login more than 180 days ago.
• credential_stuffing means more than ten distinct accounts on the same login action from one device or network prefix in an hour. Shared networks can trigger it.
• Login reasons do not raise the bot score. In block mode risky human logins get a challenge; observe and shadow report wouldDecide. Only allowed logins and passed step-ups remember devices.
• Storage failures leave verification available, with login correlation potentially unavailable. These checks do not validate passwords or replace your authentication system.

Rules: test on history before enforcing a policy that matches login reason IDs.

Related

• Step-up checks
• Repeat accounts
• Bot detection