Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.dynamic.xyz/docs/llms.txt

Use this file to discover all available pages before exploring further.

Device registration adds a layer of protection against account takeovers and phishing attacks by requiring users to verify any new or unrecognized device before they can access their account. When someone signs in from an unfamiliar device, Dynamic detects it and prompts them to confirm ownership through a verification step — blocking unauthorized access even if credentials have been compromised or harvested through a phishing site.

​
Why this stops phishing

The verification email’s link can only redirect back to domains you’ve explicitly allow-listed for your environment (the same CORS allow-list Dynamic enforces for browser requests). A phishing site running on an attacker-controlled domain will not appear in that allow-list, so even if the attacker tricks the user into clicking the verification link, the redirect — and the resulting trusted-device session — cannot land on the phishing site. The attacker is left without a registered device, and the user’s account stays protected.
Device registration is optional and disabled by default. Enable it from the Dynamic Dashboard when you’re ready to require device verification for your users. It is also gated by setting your minimum API version to 2026-04-01 — see the API version upgrade guide for details.
Device registration relies on opening an email verification link in the same browser session that initiated sign-in. It will not work for end users signing in through in-app wallet browsers (for example, the in-app browsers inside MetaMask, Trust Wallet, Rainbow, or Coinbase Wallet), because tapping the email link opens the device’s default browser instead of returning to the wallet’s in-app browser. If your app expects users on these surfaces, leave device registration disabled or provide an alternative entry point.

​
How it works

​
Returning users on a new device

When an existing user signs in from a device they haven’t used before, the following happens:
  1. Dynamic detects that the device is unrecognized
  2. The user receives an email with a verification link
  3. The user clicks the link to confirm they initiated the sign-in
  4. The device is registered as trusted and the user is granted full access
Once a device is trusted, the user won’t be prompted again on that device.

​
New users

For new users signing up for the first time, device registration happens automatically in the background. There is no additional verification step — the device they sign up from is trusted immediately, keeping the onboarding experience frictionless.

​
Verification methods

Dynamic uses different approaches to identify trusted devices:
  • Cookie-based verification — when cookie-based authentication is enabled, Dynamic uses a secure cookie to identify trusted devices
  • Public key-based verification — when cookies are not enabled, the device proves its identity cryptographically using a public key
Both methods work automatically once device registration is enabled — no additional configuration is needed.

​
Enabling device registration

Device registration is off by default. Enable it from the Dynamic Dashboard under your environment’s security settings when you’re ready to require device verification.

​
Limitations

  • In-app wallet browsers are not supported. Email verification links open in the device’s default browser, so users who initiate sign-in inside an in-app wallet browser (for example, MetaMask, Trust Wallet, Rainbow, or Coinbase Wallet) cannot complete verification and return to their original session. If your app targets these surfaces, leave device registration disabled.

​
SDK guides

For implementation details, see the guide for your SDK:
  • React SDK — Automatic UI or headless integration
  • React Native SDK — Automatic UI or headless integration for mobile
  • JavaScript SDK — Headless integration with full control over the UI and flow
  • Flutter SDK — Automatic UI or headless integration for Flutter apps
  • Swift SDK — Automatic UI or headless integration for iOS
  • Kotlin SDK — Automatic UI or headless integration for Android

​
Next steps