SignOps API

// Your server adds the token from FCM or APNs.
await signops.devices.add({
  user_id: "usr_8f21c4",   // your own user id
  token: fcmToken,
  platform: "android",          // android | ios | web
});

await signops.topics.subscribe("offers", {
  user_id: "usr_8f21c4",
});

curl https://api.signops.dev/v1/devices \
  -H "Authorization: Bearer $SIGNOPS_KEY" \
  -d user_id=usr_8f21c4 \
  -d token=$FCM_TOKEN \
  -d platform=android

import { SignOps } from "@signops/node";

const signops = new SignOps(process.env.SIGNOPS_KEY);

// Every device of this user: Android, iOS, web.
await signops.push.send({
  user_id: "usr_8f21c4",
  title: "Your order is out for delivery",
  body: "Ravi is 10 minutes away with 6 items.",
  link: "kirana://orders/88213",
});

use SignOps\SignOps;

$signops = new SignOps(getenv('SIGNOPS_KEY'));

$signops->push->send([
    'user_id' => 'usr_8f21c4',
    'title'   => 'Your order is out for delivery',
    'body'    => 'Ravi is 10 minutes away with 6 items.',
    'link'    => 'kirana://orders/88213',
]);

from signops import SignOps

signops = SignOps(os.environ["SIGNOPS_KEY"])

signops.push.send(
    user_id="usr_8f21c4",
    title="Your order is out for delivery",
    body="Ravi is 10 minutes away with 6 items.",
    link="kirana://orders/88213",
)

curl https://api.signops.dev/v1/push \
  -H "Authorization: Bearer $SIGNOPS_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "usr_8f21c4",
    "title": "Your order is out for delivery",
    "body": "Ravi is 10 minutes away with 6 items."
  }'

// A topic, an image and a send time.
await signops.push.send({
  topic: "offers",
  title: "Weekend offer: 20% off fruit",
  body: "Mangoes, bananas and apples until Sunday night.",
  image: "https://cdn.kiranaexpress.in/offers/fruit.jpg",
  send_at: "2026-10-24T18:00:00+05:30",
});

curl https://api.signops.dev/v1/push \
  -H "Authorization: Bearer $SIGNOPS_KEY" \
  -d topic=offers \
  -d title="Weekend offer: 20% off fruit" \
  -d send_at=2026-10-24T18:00:00+05:30

// Someone is signing in on the web.
// Ask the user's trusted phone.
const challenge = await signops.approve.create({
  user_id: "usr_8f21c4",
  context: "Sign in from Chrome on Windows",
});

// Show challenge.match ("47") on the login page.
const result = await signops.approve.wait(challenge.id, {
  timeout: 120,
});

if (result.status === "approved") startSession(result.user_id);

// Once, after your own login.
// Keys are made in the Keystore.
SignOps.approve.enroll(userId = "usr_8f21c4")

// The push opens the approve screen.
SignOps.approve.showPending(activity)

import { Approve } from "@signops/react-native";

await Approve.enroll({ userId: "usr_8f21c4" });

// A ready-made screen in your colours,
// or your own with Approve.pending().
<Approve.Screen brandColor="#12a463" />

import { passkeys } from "@signops/web";

// Register: the token comes from your server.
await passkeys.register({
  user_id: "usr_8f21c4",
  token: registrationToken,
});

// Sign in, with autofill in the email field.
const { signops_token } = await passkeys.signIn({
  autofill: true,
});
// Send signops_token to your server to confirm.

// A short-lived token for this user.
const { token } = await signops.passkeys.registrationToken({
  user_id: "usr_8f21c4",
  rp_id: "kiranaexpress.in",
});

// After sign-in, confirm it before starting a session.
const check = await signops.passkeys.verify(
  req.body.signops_token,
);

// Send: we make the code, hash it and email it.
const { otp_id } = await signops.otp.send({
  email: "ananya@example.in",
  app_name: "Kirana Express",
});

// Check: true once, then the code is gone.
const { valid } = await signops.otp.verify({
  otp_id,
  code: req.body.code,
});

$otp = $signops->otp->send([
    'email'    => 'ananya@example.in',
    'app_name' => 'Kirana Express',
]);

$result = $signops->otp->verify(
    $otp['otp_id'],
    $request->input('code'),
);
$ok = $result['valid'];

otp = signops.otp.send(
    email="ananya@example.in",
    app_name="Kirana Express",
)

result = signops.otp.verify(
    otp_id=otp.otp_id,
    code=request.form["code"],
)
valid = result.valid

curl https://api.signops.dev/v1/otp/send \
  -H "Authorization: Bearer $SIGNOPS_KEY" \
  -d email=ananya@example.in -d app_name="Kirana Express"

curl https://api.signops.dev/v1/otp/verify \
  -H "Authorization: Bearer $SIGNOPS_KEY" \
  -d otp_id=otp_3kd92 -d code=482913

// Every event is signed. Check it, then act on it.
const raw = express.raw({ type: "application/json" });

app.post("/signops", raw, (req, res) => {
  const event = signops.webhooks.verify(
    req.body,
    req.headers["signops-signature"],
  );

  if (event.type === "device.removed")
    db.tokens.delete(event.data.device_id);
  if (event.type === "approve.denied")
    alertSecurityTeam(event.data.user_id);

  res.sendStatus(200);
});

{
  "id": "evt_9d2kq81",
  "type": "approve.approved",
  "created": "2026-10-24T09:41:04+05:30",
  "data": {
    "challenge_id": "apr_51mz0c",
    "user_id": "usr_8f21c4",
    "device": "Pixel 8",
    "matched": true,
    "biometric": "face"
  }
}