Verify users

Weavr verifies users with their credentials, then issues an Access Token scoped to the customer they are acting for. Use that token to authenticate the user's API requests. This is the security layer for regulated financial actions. It sits behind your app's own sign-in and does not replace it.

For mobile apps, enroll users in biometric login so they can use their device biometrics on return visits instead of entering a separate Weavr password or passcode alongside their embedderEmbedder A company or developer that integrates Weavr's embedded finance services into their own application to provide financial services to their end customers. app credentials. See the iOS, Android, or React Native enrollment guidance.

The flow is:

1. Capture the user's Weavr password or passcode with a secure SDK component.
2. Send the one-time-use token to your backend, which verifies the user and returns a Weavr session token.
3. Use the Access Token to authenticate API requests for the selected customer.

A corporate user with access to more than one customer must select the customer before Weavr issues an Access Token. Some sensitive actions also require step-up authentication, using an enrolled authentication factor.

Use an SDK login component

Use a secure component to capture credentials. The plaintext value stays inside the component and never enters your app or backend.

• Web login components support password and passcode sign-in.
• iOS, Android, and React Native support the same credential flows, plus biometric login on mobile.

See End-user authentication for the API flow, customer selection, token lifetime, and using the Access Token in API calls.