Sign-in activity

Sign-in activity is the log of authentication events: sign-ins, sign-ups, resets and second-factor use, with success or failure.

In Studio

Users & auth → Records → Sign-in activity. (For one person’s full activity, including account changes and the requests they make, see A person’s activity.) A table with columns: When, User, Event, Method, Result, IP, Device. Filter to failures to see attacks; open a person’s Activity tab for just their history. Use it for questions like:

“Did Ada really sign in from there?” → open her Activity.
“Is someone guessing passwords?” → filter Result: failed, look for one IP across many users.
“Which methods do people use?” → group by Method.

What is recorded

Each entry is one authentication event:

Field	Meaning
When	The time
User and email	Who, when known. A failed sign-in for an address with no account has an email but no user.
Event (`kind`)	What happened (below)
Method (`method`)	How: `password`, `passkey`, `magic_link`, `email_code`, a social provider, `recovery`, `totp`, `api` and so on
Result (`success`)	Whether it worked
Reason	Why it failed: `locked`, `disabled`, a wrong password, an unknown passkey…
IP and Device	Where it came from, and the browser or app (user agent)

Event kinds

`kind`	When
`sign_in`	A sign-in, successful or not, by any method
`sign_out`	A person signed out
`mfa_challenge`	A second step was asked for or answered
`mfa_enrolled`	Someone set up a second factor
`passkey_added`, `passkey_removed`	A passkey was registered or removed
`password_changed`	A person changed their password while signed in
`recovery_requested`	Someone asked for a password reset link
`password_reset`	A reset link was used to set a new password

Sign-ups, verifications, account changes and session events are events you can subscribe to, and also appear in a person’s activity.

Read it from code

import { admin } from "@pawabase/client/admin";

const a = admin(pawabase);                                // a secret key
const failures = await a.insight.events({ kind: "sign_in", failed: true, limit: 200 });
const stats = await a.insight.stats();                    // users, verified, MFA, sign-ins and failures in 24h…

curl "$PAWABASE_URL/platform/v1/envs/production/auth/events?kind=sign_in&failed=true&limit=200" \
  -H "apikey: $PAWABASE_SECRET_KEY"

Query	Meaning
`kind`	Only this event kind
`failed=true`	Only failures
`limit`	Up to 500, newest first (default 100)

stats returns the number of users, how many are verified, have two-step verification on, or are disabled, sign-ups, sign-ins and failures in the last 24 hours, organizations, and how many people use each sign-in provider.

How long it’s kept

Sign-in history is kept for a period set by your plan, from 7 days on Free to 365 days on Scale. See Plans and limits. Export what you need to keep longer.

Alert on attacks

Don’t wait for the weekly review:

Subscribe a flow to session.reuse_detected (a stolen refresh token was replayed) and email your team.
Watch failures: a sudden rise in failed sign-ins from one address, or across many accounts, is password guessing or credential stuffing. Attack protection locks accounts and slows these down; the log tells you it’s happening.

Show people their own activity

A “Recent sign-ins” list on the account page lets people spot unfamiliar activity:

const events = await pawabase.auth.sessions.history();
events.map((e) => (
  <li key={e.at}>{new Date(e.at).toLocaleString()} · {e.kind} · {e.method} · {e.success ? "ok" : `failed (${e.reason})`}</li>
));

Each entry has kind, method, success, reason, ip, user_agent and at. A person only ever sees their own history.

A weekly security routine

Review failed events for repeated failures against one account or from one address.
List users with the MFA off filter who hold admin roles and ask them to enrol.
Check locked accounts.
Review user API keys and revoke ones you don’t recognise.
Take a backup: import and export.

Attack protection

Lockouts.

Auth webhooks

Alert in real time.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

What is recorded

Event kinds

Read it from code

How long it’s kept

Alert on attacks

Show people their own activity

A weekly security routine

Attack protection

Auth webhooks

​In Studio

​What is recorded

​Event kinds

​Read it from code

​How long it’s kept

​Alert on attacks

​Show people their own activity

​A weekly security routine

Attack protection

Auth webhooks

In Studio

What is recorded

Event kinds

Read it from code

How long it’s kept

Alert on attacks

Show people their own activity

A weekly security routine