Integrate TapSign the way Stripe-style docs should feel: direct, productized, and protocol-first.

curl -X POST "https://your-app.example.com/api/tapsign/login/approval/start" \
  -H "Content-Type: application/json" \
  -d '{
    "client_key_id": "tk_live_workspace_example",
    "device_ref": "dev_public_example_1234",
    "login_request_id": "site-login-123",
    "request_context": "custom-site-login"
  }'

# same-origin backend route recommended:
# your server holds connector_id + connector_private_key_b64
# the browser never sees TapSign backend credentials

import { createTapSignWebClient } from "@tapsign/universal-web-sdk";

const tapsign = createTapSignWebClient({
  apiBaseUrl: "/api/tapsign",
  clientKeyId: "tk_live_workspace_example",
});

const start = await tapsign.startLoginApproval({
  deviceRef: "dev_public_example_1234",
  loginRequestId: "checkout-admin-42",
  requestContext: "admin-login",
});

if (start.status === "pending") {
  const terminal = await tapsign.waitForLoginApprovalTerminal(start.session_id);
  if (terminal.status === "approved") {
    // ask your backend to create the real app session now
  }
}

import { useState } from "react";
import { createTapSignWebClient } from "@tapsign/universal-web-sdk";

const tapsign = createTapSignWebClient({
  apiBaseUrl: "/api/tapsign",
  clientKeyId: process.env.NEXT_PUBLIC_TAPSIGN_CLIENT_KEY_ID!,
});

export function useTapSignLoginApproval() {
  const [status, setStatus] = useState<"idle" | "pending" | "approved" | "denied">("idle");

  async function start(registeredDeviceRef: string, loginRequestId: string) {
    const session = await tapsign.startLoginApproval({
      deviceRef: registeredDeviceRef,
      loginRequestId,
      requestContext: "react-login",
    });

    if (session.status === "pending") {
      setStatus("pending");
      const terminal = await tapsign.waitForLoginApprovalTerminal(session.session_id);
      setStatus(terminal.status === "approved" ? "approved" : "denied");
      return terminal;
    }

    setStatus(session.status === "approved" ? "approved" : "denied");
    return session;
  }

  return { start, status };
}

final tapsign = TapSignFlutter(
  apiBaseUrl: const String.fromEnvironment("TAPSIGN_API_BASE_URL"),
  clientKeyId: const String.fromEnvironment("TAPSIGN_CLIENT_KEY_ID"),
  connectorId: const String.fromEnvironment("TAPSIGN_CONNECTOR_ID"),
  connectorPrivateKeyB64: const String.fromEnvironment("TAPSIGN_CONNECTOR_PRIVATE_KEY_B64"),
);

final session = await tapsign.startLoginApproval(
  deviceRef: deviceRef,
  loginRequestId: "mobile-login-123",
  requestContext: "flutter-login",
);

final terminal = await tapsign.waitForLoginApprovalTerminal(session.sessionId);
if (terminal.status == "approved") {
  // continue the app sign-in flow
}

TapSignClient client = TapSignClient.builder()
    .apiBaseUrl(System.getenv("TAPSIGN_API_BASE_URL"))
    .clientKeyId(System.getenv("TAPSIGN_CLIENT_KEY_ID"))
    .connectorId(System.getenv("TAPSIGN_CONNECTOR_ID"))
    .connectorPrivateKeyB64(System.getenv("TAPSIGN_CONNECTOR_PRIVATE_KEY_B64"))
    .build();

LoginApprovalStartResponse session = client.loginApproval().start(
    new LoginApprovalStartRequest(
        "tk_live_workspace_example",
        "dev_public_example_1234",
        "bank-console-login-99",
        "java-backend-login"
    )
);

LoginApprovalStatusResponse terminal =
    client.loginApproval().waitForTerminal(session.sessionId());

client := tapsign.NewClient(tapsign.Config{
    APIBaseURL:  os.Getenv("TAPSIGN_API_BASE_URL"),
    ClientKeyID: os.Getenv("TAPSIGN_CLIENT_KEY_ID"),
    ConnectorID: os.Getenv("TAPSIGN_CONNECTOR_ID"),
    ConnectorPrivateKeyB64: os.Getenv("TAPSIGN_CONNECTOR_PRIVATE_KEY_B64"),
})

session, err := client.LoginApproval.Start(ctx, tapsign.LoginApprovalStartRequest{
    ClientKeyID:    "tk_live_workspace_example",
    DeviceRef:      "dev_public_example_1234",
    LoginRequestID: "ops-console-login-9",
    RequestContext: "go-backend-login",
})
if err != nil {
    return err
}

terminal, err := client.LoginApproval.WaitForTerminal(ctx, session.SessionID)
if err != nil {
    return err
}

import { createGuardianMiddleware } from "@tapsign/guardian-sdk";

const guardDeleteUser = createGuardianMiddleware({
  apiBaseUrl: process.env.TAPSIGN_API_BASE_URL,
  clientKeyId: process.env.TAPSIGN_CLIENT_KEY_ID,
  connectorId: process.env.TAPSIGN_CONNECTOR_ID,
  connectorPrivateKeyB64: process.env.TAPSIGN_CONNECTOR_PRIVATE_KEY_B64,
}, {
  deviceId: (req) => req.headers["x-tapsign-device-id"],
  operationKey: "destructive_admin_action",
  operationType: "admin",
  channel: "api",
});

app.post("/admin/delete-user",
  guardDeleteUser,
  async (req, res) => {
    await deleteUser(req.body.userId);
    res.json({ ok: true });
  }
);

from tapsign_otp import TapSignOtpClient

client = TapSignOtpClient(
    api_base_url="https://api.example.com",
    client_key_id="tk_live_workspace_example",
    connector_id="11111111-1111-1111-1111-111111111111",
    connector_private_key_b64="<base64-32-byte-ed25519-seed>",
)

request = client.request_otp(
    subject_ref="order-12345",
    channel="checkout",
    device_id="registered-device-id",
    request_context="high-risk-transfer",
)

verify = client.verify_otp(
    session_id=request.session_id,
    code="123456",
)