A second chance for
a challenged signup
Ask the person for proof of work or an emailed code, so a challenge does not end the flow.
Decision trace
ExampleStep-up
- Input signalsA limited or challenged verify event, less than 30 minutes old.
- Reason idsExample trigger:
repeat_device. Passing step-up is stored separately. - DecisionThe backend verifies a single-use step-up token against the pending action ref.
- GrantDefault: limited trial after passing. Full trial is an explicit policy choice.
How it works
Keep the reference
Store the verify ref with a session-bound pending action.
Run the check
Call Nolgard.stepUp with that ref. Choose proof of work or email.
Verify server-side
Consume the token and match its returned ref before granting access.
API
Example request and response. Keep the secret on your backend.
POST https://nolgard.com/v1/stepup/verify
Content-Type: application/json
{
"secret": "SITE_SECRET",
"token": "SINGLE_USE_STEPUP_TOKEN"
}
// Example: configured 100-credit trial
{
"success": true,
"ref": "ev_123",
"method": "pow",
"grant": { "share": 0.2, "credits": 20,
"requires": null }
}Limits
- Only limit or challenge events qualify, including observe-mode wouldDecide. The original verify ref expires for starting a check after 30 minutes.
- Checks expire after 10 minutes and permit at most five completion attempts. Issued tokens expire after 10 minutes and are site-bound and single-use.
- Proof of work uses SHA-256 difficulty 22. Runtime varies by device; it is not proof of personhood.
- Email codes have six digits. At most three email checks per ref and 100 email starts per hour per site. Delivery must be configured; unavailable delivery returns 503.
- An email check proves control of the entered inbox; it says nothing about ownership of an existing application account. Bind the continuation to the original session and ref.