Stolen sessions stop working
If someone copies a signed-in session onto another machine, it normally keeps working — that is how account takeover usually happens. TokenForge ties the session to the device it was created on, so the copy is useless.
What actually happens
Three things, in order. You only write code for the middle one.
Someone signs in
Your existing login stays exactly as it is. TokenForge does not replace it and never sees a password.
Their device gets a key
The browser creates a key that cannot be copied out of it — not by a script, not by an extension, not by you.
Every request proves the device
Requests carry a signature from that key. A stolen session copied to another machine cannot produce it, so it stops working.
Before you start
Two things, both from your dashboard.
- An API key. It lives on your server and must never reach the browser.
- A place to put one route — wherever your app already handles signed-in requests.
Setting it up
Two pieces: one line in the browser, one route on your server. Pick what you use.
Open the device once your session is restored, then add one server route to complete the bind.
Things worth knowing
Your login stays yours
TokenForge sits alongside whatever you already use — Google, Okta, your own accounts. It never sees a password and does not sign anyone in.
The key cannot leave the device
It is created inside the browser and marked non-extractable. No script can read it, which is what makes a copied session useless elsewhere.
Nothing breaks if we are unreachable
Binding a device is an enrichment, not a gatekeeper. If TokenForge cannot be reached, your users keep working.
Stuck on something?
The Quick Start walks through a working setup end to end, including what each screen should look like once it is right.
Open the Quick Start