The U2 Secured SDK
Verify TOTP codes, send tap-to-approve push requests, and enrol your users — from your own backend, in six languages.
Three things to understand first
- Your API key (rka_…) authenticates your backend and scopes every call to one app. It is a server-side secret.
- A user identifier is your own opaque string for a user — an internal ID, an email, an SSH login. U2 Secured never invents one for you.
- Pairing is what binds that string to a real person’s device. Until a user has paired, you cannot push to them.
The end-to-end flow
- 1Your backend mints a pairing code for a user identifier you choose.
- 2The user types that code into the U2 Secured app, binding the identifier to their account.
- 3When they next sign in, your backend calls requestPush with the same identifier.
- 4Their phone shows the request; they match the number and approve.
- 5You learn the outcome by polling, by waiting, or by webhook.
Not sure what to put in user_identifier?
It is the one concept everything else hangs off. The Enrolling users page explains what it is, how to choose one, and what happens when it changes.