Skip to main content
Risk signals are the predefined data points that Authsignal calculates each time you track an action. You can use risk signals as conditions in your rules. To see the values for an action, open the action in the Authsignal Portal and find Action response.

​
Data you need to send

If you do not send an attribute, most of the signals that use it have no value.

​
IP signals

​
IP is anonymous

ip.isAnonymous is true if the IP address belongs to a data center, for example a cloud provider. Many VPNs and proxies use these networks. For a VPN that uses a home or mobile IP address, the value is false.

​
Impossible travel

ip.impossibleTravel is true if the speed from the last verified location to the current location is more than 800 km/h. For example, Auckland to Sydney in 2 hours is true, and Auckland to Sydney in 4 days is false. Impossible travel is an estimate because it uses the IP location. Some networks, for example in-flight Wi-Fi, can cause incorrect results. If ip.isAnonymous is true, the value is always false.

​
Atypical travel

ip.atypicalTravel is true if the current location is more than 1,000 km from the last verified location. The time after the last verification has no effect. If ip.isAnonymous is true, ip.atypicalTravel is always false.

​
IP country code is in OFAC list

ip.isInOfacList is true if the IP address is in one of these countries: Belarus, Cuba, Iran, Iraq, Ivory Coast, Liberia, Myanmar, North Korea, Sudan, Syria, or Zimbabwe. This list is fixed and can be different from the current sanctions. To use a different list of countries, use an IP country code condition.

​
Device signals

​
Device is new

device.isNew is true if the user did not verify successfully on this device before. It is also true if you invalidated the device after the last verification. If you do not send a deviceId, device.isNew is always true.

​
Device is remembered

device.isRemembered is true if the user verified successfully on this device and you set a future rememberedUntil time with the update device API. The value changes to false when the rememberedUntil time passes, or when you invalidate the device.

​
Known bot

device.isBot is true if the user agent belongs to a known bot or tool, for example a search engine crawler or curl. HTTP libraries also count as bots, for example okhttp, which many Android and React Native apps use.

​
User signals

​
Has previously verified

user.hasVerified is true if the user verified successfully one or more times.

​
Counts

The counts include the current action. They cover the current month and the two months before it. device.count covers all time.

​
Last verified location

The last verified location is the location of the IP address on the tracked action where the user last completed a challenge. If Authsignal allows an action without a challenge, the last verified location does not change. If the user did not complete a challenge before, the travel signals have no value.

​
Limits of IP location

The IP location is an estimate. The IP location can be far from the user, for example:
  • If the IP database knows only the country, the location is the middle of that country.
  • In-flight Wi-Fi can show a different country, and the country can change in a few minutes.
For travel signals, use a rule with the CHALLENGE outcome, not BLOCK. When the user completes the challenge, the last verified location changes to the IP location of that action. Then, the next actions from that location do not trigger the signal.