> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk-based sign-in

> Ask for a second factor only when a sign-in looks risky, such as from a new device or an anonymous IP address.

Users sign in with email OTP or a passkey. A passkey is enough on its own. Users who used email OTP also verify by SMS, but only when the sign-in looks risky.

![A flow with a verification step for email OTP or passkey, a method branch that completes for passkey users, and a High risk sign-in rule that asks everyone else for SMS OTP when it matches](https://mintcdn.com/authsignal-23/wPTVXdR08lavcXQp/images/docs/flows/risk-based-sign-in-flow.png?fit=max\&auto=format\&n=wPTVXdR08lavcXQp\&q=85\&s=14e6fb5c97d30004eab18f78edc191f2)

Only risky sign-ins get a second step

## Build the flow

**1. Set up the methods**

Set up email OTP, passkeys and SMS OTP on the **Authenticators** page.

**2. Start from the Risk-based authentication template**

Create a Flows action, such as `signIn`, and choose the **Risk-based authentication** template. It gives you:

* A verification step that accepts **Email OTP** or **Passkey**.
* A method branch that sends passkey users to **Complete**.
* On the **Else** branch, a **High risk sign-in** rule. A rule sends users down **Yes** if it matches and **No** if it doesn't. This one matches when any of these is true:
  * **IP is anonymous**: the IP address belongs to a VPN, Tor or a proxy.
  * **Impossible travel**: the user couldn't have traveled from their last verified location in the time since.
  * **Device is new**: the device hasn't completed a verification yet.
* On the rule's **Yes** branch, a verification step that accepts **SMS OTP**. The **No** branch goes to **Complete**.

**3. Adjust the flow (optional)**

To change what counts as high risk, edit the rule's conditions.

**4. Publish the flow**

Select **Publish**. Then start and verify the flow from your backend, as in the [quickstart](https://docs.authsignal.com/flows/overview.md#quickstart). Pass the user's IP address and device ID in Start Flow's `attributes`, as `ipAddress` and `deviceId`, so the rule can check them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.