Start

Authentication Methods

Start on V2.0. The V2.0 Widget is the recommended way to verify users with Akedly: a hosted screen with the widest security tier and passkeys switched on by one iframe attribute. Choose the V1.2 REST API when you want to build the screens yourself, or when you cannot embed an iframe or open a system browser. V1.0 is legacy and sunsets on December 30, 2026. Whichever you pick, the goal is the same: verify with a code once, then let the user sign in with a passkey. See how passkeys work.

Build with AI agents

Choose your method

	V2.0 Widgets (recommended)	V1.2 REST API	V1.0 REST API (legacy)
Best for	Teams that want a finished verification screen and the widest security tier.	Teams that build their own UI, or cannot embed an iframe or open a system browser.	Existing integrations, until the sunset on December 30, 2026.
What you build	One backend call to create an attempt, an iframe on your page, and a handler for the result and webhook. Akedly runs the UI.	Your own UI and three backend calls: get a challenge, send the OTP, verify. Shield SDKs solve proof-of-work and Turnstile on the client.	Your own UI and three calls: create, activate, verify. Security is yours to build.
Passkeys	Yes. Add one iframe attribute and the widget offers passkeys when they are on for your account and pipeline. Passkey Network Registry included.	Yes. A hosted passkey page plus your backend calling `auth-options`; OTP is the fallback. Passkey Network Registry included.	No. OTP only.

Comparison

Feature	V2.0 Widgets	V1.2 REST API	V1.0 REST API
Status	Recommended	REST API	Sunsetting Dec 2026
Security Tier	Maximum (state-of-the-art)	Strong	DIY (your responsibility)
Integration Style	Iframe widget (managed UI)	REST API (your UI)	REST API (your UI)
UI Control	Managed by Akedly	Full control, no iframe	Full control, no iframe
Backend Code	1 API call	3 API calls	3 API calls
Pricing Model	PPSA eligible (requirements apply)	PPM (pay per message)	PPM (pay per message)
Captcha Protection	Built-in (widget-managed)	Configurable at pipeline level	Implement your own
Device Fingerprinting	Built-in (widget-level)	Not provided by this REST route	Implement your own
Rate Limiting	Built-in (widget-level)	Built-in (pipeline-level)	Implement your own
Circuit Breaker	Built-in	Built-in	Implement your own
Custom Branding	Logo, colors, company name	Fully customizable (you build it)	Fully customizable (you build it)

How the Three Methods Differ on Security

RESTful APIs are inherently more exposed to certain attack vectors than managed widgets — this is a known industry characteristic, not specific to Akedly. V1.0 gives you the building blocks; security is in your hands. V1.2 adds configurable Proof-of-Work and Turnstile checks plus pipeline rate limiting and circuit breaking; it does not add browser device fingerprinting on the OTP route. V2.0 adds widget-level device identity and a managed iframe defense layer for teams that need it.

V2.0 Widgets

Every V1.2 protection, plus a managed iframe layer

V2.0 Widgets deliver the maximum security tier — every protection in V1.2 plus an iframe-based defense layer Akedly manages for you. PPSA-eligible for qualifying startups.

V2.0 Widgets are a hosted verification screen you embed in an iframe. Your backend creates an attempt, Akedly runs the code flow, captcha, device checks and rate limits in the widget, and your server gets the result by redirect, postMessage and webhook. It is the recommended way to verify users with Akedly, and the shortest route to passkeys.

Maximum Security Tier

V2.0 layers a managed iframe widget on top of every protection V1.2 ships with. The iframe boundary itself becomes a defense layer Akedly maintains, hardens, and updates — so you stay on the latest threat-detection improvements without redeploying.

Name
Bot Protection
Description
Prevents automated abuse and reduces fraudulent authentication attempts
Name
Device Fingerprinting
Description
Identifies and tracks unique devices across authentication sessions
Name
Circuit Breaker
Description
Advanced flood protection that adapts to traffic patterns
Name
Risk Scoring
Description
Real-time fraud detection with proprietary algorithms

PPSA Eligibility

Qualifying startups can access Pay-Per-Successful-Authentication pricing. Requirements apply.

Potential Cost Savings (for eligible users):

V1.0 / V1.2 (Pay-per-message): Charged for every OTP sent
V2.0 (PPSA): Only charged for verified users

Additional Benefits

Telegram Support - Reach users on Telegram in addition to WhatsApp, SMS, and Email
30-Minute Integration - Drop-in widget requires minimal code
Responsive Design - Mobile-optimized UI works on all devices
Customizable Branding - Match your brand colors and styling
Real-time Analytics - Advanced dashboard metrics for fraud and device insights
Auto-scaling - Handles traffic spikes automatically
Zero Maintenance - Akedly manages updates and security patches

Perfect For

Regulated industries (finance, healthcare) needing the highest security tier
Production applications where managed security beats DIY control
Startups seeking PPSA eligibility
Teams wanting fast integration
Applications needing Telegram support
Businesses concerned about sophisticated bot traffic and fraud

Getting Started

View V2.0 Widgets documentation

Integration Time: 30 Minutes

Most developers integrate V2.0 Widgets in under 30 minutes. The pre-built UI and security features eliminate weeks of development time.

V1.2 REST API (Akedly Shield)

V1.2 is the REST API for teams that want full control of the UI. You call three endpoints (get a challenge, send the OTP, verify) and Akedly Shield adds proof-of-work and Cloudflare Turnstile on the client when the pipeline has them on. No iframe is required.

V1.2 wraps the familiar V1 REST API with Akedly Shield -- a client-side security layer that applies Proof-of-Work and Turnstile verification when those pipeline controls are enabled. Same REST simplicity, configurable protection.

Why Choose V1.2

Name
Proof-of-Work
Description
Clients solve a computational challenge before receiving an OTP when PoW is enabled for the pipeline. Deters bot abuse without user friction.
Name
Turnstile Captcha
Description
Cloudflare Turnstile verification when enabled for the pipeline. No third-party captcha integration needed.
Name
Pipeline-Level Security
Description
Rate limiting and circuit breaking are applied at the pipeline level according to its configuration.
Name
Full UI Control
Description
No iframe required. Build your own UI and use Shield SDKs for the security layer.

Shield SDKs

Official SDKs handle PoW solving and Turnstile for you:

Web: @akedly/shield (npm + CDN)
Flutter: akedly_shield (GitHub, pubspec git: dependency)
iOS: AkedlyShield (SPM via GitHub URL)
Android: akedly-shield-kotlin (GitHub via JitPack)
React Native: @akedly/shield (npm)

Getting Started

View V1.2 Documentation

V1.0 REST API

V1.0 Sunset Extended to December 30, 2026

V1.0 REST API sunsets December 30, 2026. Migrate to V1.2 for the same REST simplicity with configurable security controls.

The V1.0 REST API provides direct server-to-server authentication with a 3-step flow: create transaction, activate/send OTP, and verify.

When to Use V1.0

You have an existing V1.0 integration
You need full UI control with no iframe
You prefer a straightforward REST API approach
You handle your own rate limiting and bot protection

Trade-offs

No PPSA pricing -- Pay-per-message only
No Telegram support
No built-in security -- Captcha, fingerprinting, rate limiting are your responsibility
Sunsetting December 30, 2026 -- Migrate to V1.2 for a smooth transition

Getting Started

Start new integrations on V2.0, or on V1.2 if you cannot embed an iframe or open a system browser. If you have an existing V1.0 integration and need the V1.0 reference, contact us and we will send it to you.

V1.2 is the REST Replacement

V1.2 wraps V1 with configurable Proof-of-Work and Turnstile checks, plus pipeline rate limiting and circuit breaking — no iframe required. View V1.2 docs

Decision Guide

Choose V2.0 if you want Akedly to run the verification screen, you want the widest security tier, or you are a qualifying startup looking at pay-per-successful-authentication pricing.

Choose V1.2 if you want full control of the UI, you cannot embed an iframe or open a system browser (for example, a pure REST backend or a native app that cannot hand off to one), or you want SDK-level control of the flow.

Choose V1.0 only if you already run it. It sunsets on December 30, 2026; migrate to V1.2 or V2.0.