How it works
What happens between the request and the answer
REAL AUTH turns a vague question — is this person genuine? — into a specific one that can be answered with a signature.
Something needs to be verified
A sign-in, a payment instruction, a change of bank details, an urgent phone call. The requesting application describes exactly what it wants confirmed: which site, which account, which organisation, which role, which values, and for how long the answer stays valid.
The request is turned into an intent
An intent is the request written down in a fixed, unambiguous form. It carries a challenge that has never been used before and an expiry measured in minutes. Two requests that differ in any bound value are two different intents, and an approval of one is not an approval of the other.
The person sees what is actually being asked
Not a bare "approve?" prompt. The trusted device shows the domain doing the asking and the values that will be committed, because an approval nobody read is not consent — it is a habit.
This is why REAL AUTH shows the full destination account or wallet address rather than the first and last four characters. An attacker can match a truncated address; they cannot match the whole one.
The device signs, and the biometric stays put
Face, fingerprint or PIN unlocks a private key held inside the device's secure hardware. That key cannot be exported. REAL AUTH never receives, stores or processes biometric data of any kind — only a signature that the key produced.
The signature is checked against the intent
The server verifies the signature, that the challenge is the one it issued, that it has not been used before, that the origin matches, and that the intent has not expired. Any failure is a failure; nothing is waved through.
The result is bound and short-lived
The answer covers exactly the values that were shown. Change one of them and the approval no longer applies. Wait too long and it expires. There is no state in which an old approval quietly authorises a new request.
See it in a real integration
The sandbox runs the same flows as production, with credentials that cannot reach production data.