One post tagged with "webhooks"

Not every login deserves the same treatment. A password typed in from the same laptop as always is one thing; the same password showing up from a country the user's never logged in from is another — and asking for MFA on every single sign-in just to catch the second case annoys everyone hitting the first.

O2ID's condition node can make simple calls like that, but only within limits: it evaluates a CEL expression with deliberately no loops, no variables, and no network access. A tenant admin writes the expression, and it has to be safe to evaluate blind every single time — keeping it that limited is what makes that safe. Real risk decisions rarely fit in one expression, though. "Is this login suspicious?" usually means asking an external fraud-scoring service, then weighing whatever it says back — a handful of signals, each worth something different, added up into a score. That needs a function, not a condition.

This post wires up a login flow that calls a fraud-check service through a webhook node, folds the answer into a step-up decision with a script node, and only asks for TOTP when the score says so.