Credentials are issued per app, not per use case. The same client_id and secret cover every action you verify — login, payments, profile changes, approvals — so you set this up once.

​
Checklist

1

API base URL

{BASE} is https://authentica-merge-integration.t2.sa.Your backend uses it for all three back-channel calls:
  • {BASE}/api/V1/Verify/session
  • {BASE}/api/V1/Verify/session/{sessionId}
  • {BASE}/api/V1/Verify/revoke
This is not your app URL. Store it as AUTHENTICA_BASE_URL.For the browser, use the verifyUrl returned by /session as-is — do not build the hosted verify page URL yourself, and never append anything to it. It is opened with a form POST, not a navigation.
2

client_id and secret

Issued per app.
  • client_id — safe to log for debugging; still prefer server-side only
  • secret — never put in frontend code, mobile apps, or public repos
Store the secret in your server config / secret manager. These two values are the only credentials in the integration; there is no second secret of any kind.
3

Register your Return URLs

You register the page the user’s browser lands on after verification. Register one per environment — your local machine, staging, production — and send whichever one applies on each POST /session.There is no other kind of URL to register. Authentica never calls your server, so there is no receiver to point at.The match is a whole-string comparison against each registered URL. Scheme, host, port, path and case must be identical to what you send on every POST /session — no trailing slash unless you registered one, and no query string. A returnUrl that matches none of them fails the session create with invalid_return_url.You need one URL per environment, not one per action. Use state to remember which action the user was verifying — see Routing many actions through one return URL.A mobile app registers its deep link (a custom scheme myapp://verify/callback, or an https App/Universal Link) as the returnUrl here in exactly the same way — see Mobile apps.
4

Use SMS

Delivery is SMS only. When your backend calls POST /session, send "channel": "sms" and the phone as destination.

​
Where to put values in your project

​
HTTP Basic auth format

Every back-channel call uses:
Example (Node):

​
Next

Credentials ready? Continue to the Quickstart and wire the end-to-end flow.