May 6, 2026 — We just turned on anomaly detection for every SyAuth account. New-device alerts, new-country flags, and impossible-travel detection run on every successful login — no configuration required, no add-on tier.
This is the category Auth0 sells as Adaptive MFA and paywalls on higher tiers. We ship it free.
What the detectors catch
- New device. An unseen browser + OS + IP combination, normalised so minor Chrome version bumps don't false-positive.
- New IP. Exact IP the user has never logged in from before, on a device they already use. Informational — useful for noticing coffee-shop Wi-Fi vs. a real anomaly.
- New country. First successful sign-in from a given country code. Warns.
- Impossible travel. Two sessions geographically distant enough that getting between them would require > 800 km/h — faster than any scheduled flight. Critical severity, triggers an immediate email.
What users see
On the /security/sessions page, a new Recent security activity section lists every anomaly with severity badges (info / warning / critical), a plain-English summary, and a "That was me" acknowledge button. If a sign-in wasn't them, they revoke the matching session from the next section down — both refresh and access tokens go to the persistent denylist.
On high-severity anomalies (new_device, new_country, impossible_travel), SyAuth sends a templated email through the same per-client EmailTemplate pipeline used for magic-link and verification emails. Customise the copy on your OAuth client; disable globally with ANOMALY_EMAIL_ON_NEW_DEVICE=False.
Built to be cheap
- Non-blocking. Detection runs after the session row is committed. If a geo lookup hangs on a slow API, the user's login still finishes.
- Every detector in its own try/except. One failing detector never cascades.
- Geo is optional. Set
IPINFO_TOKENto enable country and travel checks; without it, new-device and new-IP still work. - One query per login. Pattern checks against the user's own session history — no background worker, no ML inference, no data shipped to third parties by default.
Roadmap reserved
Two follow-ups are already shaped: credential-stuffing detection on failed-login bursts (building on the audit log), and step-up MFA when an anomaly scores critical. Both ship on the same infrastructure without new schema.
Docs: developers.nexorix.com/syauth. Available today on every plan.