Skip to main content
Use backend mode when your server must receive the approved identity and decide whether to create an application session. The browser receives a completion notification rather than the identity payload.

​
1. Register a callback

From your server, send POST /QuickLogin to the chosen Neuron:
Generate an unpredictable, single-use sessionId on your backend and associate it with the browser’s pending login attempt. Keep the callback URL under your control. Return the resulting serviceId to that browser. A service registration lasts five minutes. To extend it before expiry, repeat the registration with all three fields:
The response repeats serviceId and the registration receives another five minutes. Do not assume QR refresh alone renews the backend registration.

​
2. Display the QR code

Follow the browser quickstart, passing the registered identifier instead of an empty serviceId:
When using the reference HTML integration, supply the same identifier as the data-serviceId attribute of quickLoginCode.

​
3. Process the callback

After approval, the Neuron POSTs the identity object to your callback. The additional SessionId field identifies the original attempt. Request fields use sessionId; this response field uses SessionId. Your callback must return JSON; null is an acceptable response body. Process attempts atomically so duplicate or replayed callbacks cannot create multiple sessions. Reject unknown, expired, cancelled, or already completed attempts. Before granting access, validate the identity and the callback’s provenance using your provider’s supported verification mechanism, then apply your application’s identity and authorization rules. An incoming HTTP body with Id and SessionId is not by itself proof of authentication. The public guide does not specify a callback authentication header or signature-verification algorithm; establish those details with the provider before enabling production login. Do not log the complete callback or put identity data, callback keys, or attachment URLs into browser URLs. Rotate the application’s session identifier on successful login.

​
4. Update the browser

Once the backend responds, the Neuron sends SignatureReceivedBE with an empty string to the registered browser tab. Stop refreshing the QR and ask your backend for the authenticated session state using the browser’s existing session cookie. Treat this event as a prompt to check the backend. Your server’s verified state determines whether the user is signed in. Handle a missed event by offering a session-status check, and expire pending attempts even when a tab disappears. The callback delivery and completion event are described in the provider’s backend guide. Callback retry guarantees and error codes are not specified there; make the handler idempotent and test failures with your deployment.