AuthGuard Request a demo

ProofFlow · critical-action approval

Approve the operation, not just the person.

A payment, an access change or a console setting deserves more than a yes. ProofFlow shows the exact values, binds the confirmation to that request and records the decision in a signed receipt you can verify outside the service.

Plan a pilot See how it works
  • Canonical request · SHA-256
  • Comparison code
  • Decided once
  • Signed receipt
ProofFlow · request from a systemillustrative example

ERP · screen

Pay invoice INV-42

€1,250.00 · Example Supplies Ltd

205 731

comparison code

Phone

Approve: Pay invoice

Requested by Finance ERP

205731
Approve
Signed receiptapproved · ML-DSA-65 (+ Ed25519 in hybrid mode)
  1. Request created
  2. Code compared
  3. Decision confirmed
  4. Receipt issued

Watch

Proof that stays with the operation.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

Proof that stays with the request.

ProofFlow is AuthGuard’s MFA for critical actions, and the same engine protects the console, application sign-in and requests from your other systems. See the comparison with common MFA.

  1. 01 · Request

    Pin down what is being approved

    The request is written in a canonical form with the operation, its fields and its deadline. A SHA-256 digest covers the whole request.

  2. 02 · Code

    Compare screen and phone

    Six digits derived from the digest travel with the request. On the phone, the person types the code the screen shows, or confirms that it matches; if the request is swapped, the codes no longer match.

  3. 03 · Confirmation

    Passkey or phone

    The passkey signs that request and nothing else. Where the operation type allows it, phone approval is confirmed with biometrics or a PIN.

  4. 04 · Receipt

    The decision is signed

    Each request is decided once, and the decision produces a receipt signed with ML-DSA-65, plus Ed25519 when the installation signs in hybrid mode. It can be verified offline with the installation’s public keys.

Illustrative example

A €1,250 invoice, and someone who can say no.

The ERP needs authorisation to pay invoice INV-42. It creates a request through the intents API with the amount and the payee, and shows the comparison code next to the operation.

Ana sees the same values in the console or on her phone. If she does not recognise the request, she declines it. If she approves, the ERP receives the decision by webhook or by polling, verifies the receipt and only then makes the payment.

For integrators

One API, verifiable proof.

Intents API

Ask for a decision from your own systems

  • Operation types with up to 16 typed fields: amounts, dates, choices
  • A required Idempotency-Key, so retries never duplicate
  • Webhooks signed with HMAC-SHA-256 (Standard Webhooks)
  • SDKs for TypeScript, Python, Java, .NET and Go
Console

Protect administrative changes

  • Every change needs a recent passkey or approval
  • Organisations can require phone approval
  • Helpdesk factor resets need dual approval
  • An access policy that denies by default
Evidence

Verify without relying on us

  • The receipt names the request, its digest, the decision and the factor used
  • Verifiable outside the service with the installation’s public keys
  • Not a qualified signature, and no third-party timestamp
  • Append-only audit log with cryptographic chaining

Worth knowing

  • Phone approval is available on Android 14 or later. On an iPhone, use a passkey.
  • In the default mode, the requesting system must display the comparison code; without it, the person cannot approve on the phone.
  • Decisions on requests from other systems are not evaluated by the access policy, so your system applies its own business rules.
  • AuthGuard does not carry out the operation. Your system verifies the receipt and only then executes.

In the help centre

Pilot

Choose one critical operation.

A payment, an access change or an administrative task. We define the fields, the approval path and the receipt check before execution with you.

geral@authguard.pt