You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: app/en/home/auth/secure-auth-production/page.mdx
+59-16Lines changed: 59 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,28 +8,35 @@ description: "How to secure and brand your auth flows in production"
8
8
To keep your users safe, Arcade.dev performs a user verification check when a tool is authorized for the first time. This check verifies that the user who is authorizing the tool is the same user who started the authorization flow, which helps prevent phishing attacks.
9
9
10
10
There are two ways to secure your auth flows with Arcade.dev:
11
+
11
12
- Use the **Arcade user verifier** for development (enabled by default)
12
13
- Implement a **custom user verifier** for production
13
14
14
15
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard.
15
16
16
-
17
17
## Use the Arcade user verifier
18
18
19
19
If you're building a proof-of-concept app or a solo project, use the Arcade user verifier. This option requires no custom development and is on by default when you create a new Arcade.dev account.
20
20
21
21
This setting is configured in the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard:
22
22
23
-
<imgsrc="/images/docs/auth/dashboard-arcade-verifier.png"alt="An image showing how to pick the Arcade user verifier option in the Arcade Dashboard"className="rounded-sm shadow-md"width="600" />
alt="An image showing how to pick the Arcade user verifier option in the Arcade Dashboard"
26
+
className="rounded-sm shadow-md"
27
+
width="600"
28
+
/>
24
29
25
30
When you authorize a tool, you'll be prompted to sign in to your Arcade.dev account. If you are already signed in (to the Arcade Dashboard, for example), this verification will succeed silently.
26
31
27
32
The Arcade.dev user verifier helps keep your auth flows secure while you are building and testing your agent or app. When you're ready to share your work with others, implement a [custom user verifier](#build-a-custom-user-verifier) so your users don't need to sign in to Arcade.dev.
28
33
29
34
<Callouttype="info">
30
35
Arcade's default OAuth apps can *only* be used with the Arcade user verifier.
31
-
If you are building a multi-user production app, you must obtain your own OAuth app credentials and add them to Arcade.
32
-
For example, see our docs on [configuring Google auth in the Arcade Dashboard](/home/auth-providers/google#access-the-arcade-dashboard).
36
+
If you are building a multi-user production app, you must obtain your own
37
+
OAuth app credentials and add them to Arcade. For example, see our docs on
@@ -55,26 +62,27 @@ The route must gather the following information:
55
62
56
63
How the user's unique ID is retrieved varies depending on how your app is built, but it is typically retrieved from a session cookie or other secure storage. It **must** match the user ID that your code specified at the start of the authorization flow.
57
64
58
-
59
65
### Verify the user's identity
60
66
61
67
Use the Arcade SDK (or our REST API) to verify the user's identity.
62
68
63
69
<Callouttype="warning">
64
-
Because this request uses your Arcade API key, it *must not* be made from the client side (a browser or desktop app). This code must be run on a server.
70
+
Because this request uses your Arcade API key, it *must not* be made from the
71
+
client side (a browser or desktop app). This code must be run on a server.
In the [Auth > Settings section](https://api.arcade.dev/dashboard/auth/settings) of the Arcade Dashboard, pick the **Custom verifier** option and add the URL of your verifier route.
211
248
212
-
<imgsrc="/images/docs/auth/dashboard-custom-verifier.png"alt="An image showing how to pick the custom verifier option in the Arcade Dashboard"className="rounded-sm shadow-md"width="600" />
0 commit comments