Skip to main content
Use the current identification and account history to choose where to add authentication friction.

​
Where to integrate

Identify before enabling the sensitive session or account action. Start with the SDK for your stack and retrieve the result on your backend.

​
What to read

Review risk signals, an unfamiliar verified device and any sharing, travel or takeover evaluation. Use the current Risk Score and flags, plus High-Risk Events where relevant. Treat a missing or incomplete result as an explicit unverified state.

​
How to act

Require your existing second factor and bind successful verification to the same session and action. Exclude the current identification when comparing previous devices. Handle result delays with a defined pending state.

​
Build the example

The runnable tutorial includes the starting app, the completed integration, and steps to test its behavior. Its application policy is stated separately from ShieldLabs detection. For implementation details, see Acting on results and Identification flow. Verify the expected domain, result age and account association, and consume protected actions atomically.