@verifa.i/web-sdk

Zero-knowledge device trust for web apps. Verify the device, not just the password.

Install

npm install @verifa.i/web-sdk

Or via CDN:

<script src="https://cdn.jsdelivr.net/npm/@verifa.i/[email protected]/dist/verifai.umd.min.js"></script>

Quick start

import VerifAI from "@verifa.i/web-sdk";

VerifAI.init({ apiKey: "vf_live_xxxxxxxx" });

async function onLoginSubmit(email, password) {
    // 1. Your own auth check first
    const ok = await myApi.checkPassword(email, password);
    if (!ok) return showError("wrong password");

    // 2. Verify the device — every login hits the API
    const result = await VerifAI.verifyDevice(email);

    if (result.status === "trusted") {
        // Known device. Trust score grows with each login.
        goToDashboard();
        return;
    }

    if (result.status === "pending") {
        // New device. User's phone gets a push notification.
        showWaitingScreen("Approve on your phone…");

        const approval = await VerifAI.waitForApproval(result.sessionId);

        if (approval.status === "approved") {
            goToDashboard();
        } else {
            showFraudScreen(approval.reason);
        }
        return;
    }

    // status === "rejected" or "error"
    showFraudScreen(result.reason);
}

What's new in v1.2.0

• Every login calls the API — no more local-only fast path. Trust score increments on every successful login. Usage is tracked per API key.
• Signal hashing — browser fingerprint signals are now hashed and sent to the API for comparison, matching the Android SDK's approach.
• Unified endpoint — uses /verifyDevice instead of separate /createSession + /listDevices. Cleaner flow, single API call per login.

API

VerifAI.init(config)

Call once, at application startup.

VerifAI.init({
    apiKey: "vf_live_xxx",   // required
    baseUrl: "...",          // optional, override API URL
    publicIpUrl: "..."       // optional, override IP lookup
});

VerifAI.verifyDevice(userId)

Run after your own password check. Every call hits the API — usage is tracked, trust score increments.

const r = await VerifAI.verifyDevice("[email protected]");
// r.status: "trusted" | "pending" | "rejected" | "error"
// r.sessionId    — when status === "pending"
// r.deviceId     — stable id for this browser
// r.trustScore   — 0–100 (when trusted, grows with logins)
// r.reason       — when rejected / error

VerifAI.waitForApproval(sessionId, options?)

Poll until approved, rejected, or timed out.

const a = await VerifAI.waitForApproval(result.sessionId, {
    timeoutMs: 20000,          // default 2 min
    pollIntervalMs: 2000,      // default 2s
    onPoll: (status) => {},    // called every tick
});
// a.status: "approved" | "rejected" | "timeout"

VerifAI.listDevices(userId)

const devices = await VerifAI.listDevices("[email protected]");

VerifAI.removeDevice(deviceId)

await VerifAI.removeDevice("abc123");

VerifAI.clearLocalDevice()

Forgets the local cert. Next verifyDevice() call will be treated as a new device by the API.

VerifAI.getCurrentDeviceId()

const id = await VerifAI.getCurrentDeviceId();

TypeScript

Full types ship with the package:

import VerifAI, { VerifyDeviceResult, VerifAIError } from "@verifa.i/web-sdk";

Browser support

Chrome, Firefox, Safari, Edge. Requires crypto.subtle, fetch, localStorage.

License

Proprietary. Contact VerifAI for licensing.