> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Login with your backend

> Deliver approved identities to an HTTPS callback and bind them to an application session

Use backend mode when your server must receive the approved identity and decide whether to create an application session. The browser receives a completion notification rather than the identity payload.

## 1. Register a callback

From your server, send `POST /QuickLogin` to the chosen Neuron:

```bash theme={null}
curl --request POST 'https://<NEURON_HOST>/QuickLogin' \
  --header 'Content-Type: application/json' \
  --data '{"service":"https://app.example.com/auth/quick-login/callback","sessionId":"<OPAQUE_ATTEMPT_ID>"}'
```

```json theme={null}
{ "serviceId": "<SERVICE_ID>" }
```

Generate an unpredictable, single-use `sessionId` on your backend and associate it with the browser's pending login attempt. Keep the callback URL under your control. Return the resulting `serviceId` to that browser.

A service registration lasts **five minutes**. To extend it before expiry, repeat the registration with all three fields:

```json theme={null}
{
  "service": "https://app.example.com/auth/quick-login/callback",
  "sessionId": "<OPAQUE_ATTEMPT_ID>",
  "serviceId": "<SERVICE_ID>"
}
```

The response repeats `serviceId` and the registration receives another five minutes. Do not assume QR refresh alone renews the backend registration.

## 2. Display the QR code

Follow the [browser quickstart](/quick-login/quickstart), passing the registered identifier instead of an empty `serviceId`:

```json theme={null}
{
  "serviceId": "<SERVICE_ID>",
  "tab": "<REGISTERED_TAB_ID>",
  "mode": "base64",
  "purpose": "Sign in to Example using my Legal Identity."
}
```

When using the reference HTML integration, supply the same identifier as the `data-serviceId` attribute of `quickLoginCode`.

## 3. Process the callback

After approval, the Neuron POSTs the [identity object](/quick-login/identity-response) to your callback. The additional `SessionId` field identifies the original attempt. Request fields use `sessionId`; this response field uses **`SessionId`**.

Your callback must return JSON; `null` is an acceptable response body. Process attempts atomically so duplicate or replayed callbacks cannot create multiple sessions. Reject unknown, expired, cancelled, or already completed attempts.

Before granting access, validate the identity and the callback's provenance using your provider's supported verification mechanism, then apply your application's identity and authorization rules. An incoming HTTP body with `Id` and `SessionId` is not by itself proof of authentication. The public guide does not specify a callback authentication header or signature-verification algorithm; establish those details with the provider before enabling production login.

Do not log the complete callback or put identity data, callback keys, or attachment URLs into browser URLs. Rotate the application's session identifier on successful login.

## 4. Update the browser

Once the backend responds, the Neuron sends `SignatureReceivedBE` with an empty string to the registered browser tab. Stop refreshing the QR and ask your backend for the authenticated session state using the browser's existing session cookie.

Treat this event as a prompt to check the backend. Your server's verified state determines whether the user is signed in. Handle a missed event by offering a session-status check, and expire pending attempts even when a tab disappears.

The callback delivery and completion event are described in the [provider's backend guide](https://eu.quicklog.in/QuickLogin.md#backEndMode). Callback retry guarantees and error codes are not specified there; make the handler idempotent and test failures with your deployment.