Audit Logs

⚡ 4 min read

An append-only trail of member actions in your project — custom app events via the SDK and step-up MFA outcomes. AI Agent (MCP) audit rows are Coming Soon.

Every row is tied to a member (name, email, role, IP, user agent). The server enriches rows automatically — do not send identity fields from the client.

Which token writes the log?

Different surfaces authenticate differently, but all rows land in the same project audit log.

Surface	Token	Stored where	What gets logged
Your web app (SDK)	SDK access JWT (`aud: transcodes-sdk`)	Browser secure storage after hosted sign-in	`trackUserAction()` from your code; step-up MFA on Transcodes Auth when redirectToStepUp runs
AI agent (MCP)	—	—	Coming Soon

Automatic audit logging for AI Agent (MCP) is Coming Soon. Installation is not available yet.

Recording events (SDK)

From your app, use the SDK while the user is signed in. Login and logout are not logged automatically — after hosted sign-in succeeds, and before token.signOut(), call trackUserAction with member:login / member:signout.


// After sign-in
await transcodes.trackUserAction({
  tag: 'member:login',
  severity: 'medium',
  status: true,
  metadata: { method: 'hosted-redirect' },
});
 
// Before sign-out
await transcodes.trackUserAction({
  tag: 'member:signout',
  severity: 'medium',
  status: true,
});
await transcodes.token.signOut();
 
// Other sensitive actions
await transcodes.trackUserAction({
  tag: 'documents:delete',
  severity: 'high',
  status: true,
  metadata: { documentId: 'doc_123' },
});

Field	Notes
`tag`	Convention: `{resource}:{action}` (e.g. `member:login`)
`severity`	`low` · `medium` · `high`
`status`	`true` = success, `false` = failure

Pass { webhookNotification: true } as the second argument to force an outbound notification (see Webhook).

Use trackUserAction from the SDK while the member is signed in.

AI Agent (MCP) audit logs — Coming Soon

Automatic audit logging for AI Agent (MCP) actions is Coming Soon. Installation and MCP log queries are not available yet.

Viewing logs

Console: Authentication Kit Cluster → Audit Logs — charts and searchable history. Filter by member, tag, severity, or date range.

API: GET /v1/audit/logs (Console session or project API token). Filters: date range, tag, member_id, severity.

MCP: Coming Soon. Do not treat get_security_logs as available yet.

Retention: audit log history is unlimited on every organization. Date filters are optional and are not billing-gated.

AI Agent (MCP) — Coming Soon Webhook RBAC