Analytics

The Observability tab (the dashboard sometimes shows it as Analytics) gives you a four-panel snapshot of your application's auth health. The page is a sidebar of sub-pages, with Overview as the landing screen.

┌─────────────────────────┬─────────────────────────┐
│ Authentication Requests │ User Signups            │
│  successful  / failed   │  new users per day      │
├─────────────────────────┼─────────────────────────┤
│ Security Events         │ Account Activity        │
│  failed-login reasons   │  locked / MFA-enabled   │
└─────────────────────────┴─────────────────────────┘

Pick a date range from the header (7 days / 30 days / 90 days / custom). Every chart updates together.

Where it lives#

Dashboard → Application → Observability. Sidebar:

• Overview — the four-panel home page (this page).
• Security — failed logins, blocked sign-ups, suspicious patterns.
• Users — signup curve, MAU trends, retention.
• Auth Methods — which providers your users are choosing.

Overview#

Authentication Requests#

Two-line area chart: successful logins vs failed logins per day. The successful line should track your DAU; the failed line is your noise floor — sustained spikes are usually credential-stuffing or brute-force runs and warrant a look at the Security page.

A click on the chart drills into the Security page filtered to that date.

User Signups#

Single-line area chart: new accounts created per day. Click anything to land on the Users page filtered to that date range. Useful for verifying that a marketing push actually translated to signups, or that your latest signup rule didn't strangle the funnel.

Security Events#

Bar chart: count of failed logins broken down by reason (invalid_password, account_locked, user_not_found, mfa_required_but_missing, etc.). The shape of the distribution tells you what to fix next:

• Tall invalid_password bar → users forgetting passwords. Improve the magic-link or passkey signage.
• Tall user_not_found bar → either a typo-prone email signup field or someone enumerating users. Pair with the Security page to investigate.
• Tall mfa_required_but_missing → users hit the MFA wall mid-flow. Often a sign your enforcement just turned on without a clear migration message.

If there's nothing to chart, the panel shows "No security events in this period." That's good news.

Account Activity#

Bar chart with two cards: Locked Accounts and MFA Enabled. The first should trend toward zero (it's a count of users currently in the lockout state). The second should trend up as your enforcement matures.

Security (sub-page)#

Drill-down view of the security panel:

• Failed logins by reason — same chart as above, plus a daily timeline.
• Top offending IPs — IPs with the most failed login attempts. Useful when fingerprinting an attacker.
• Top targeted accounts — accounts that are receiving the most failed attempts. Pair with account lockout thresholds.
• Anomalies — sudden spikes vs the trailing baseline.

The page emits an alert badge when activity crosses a threshold — sustained > 50 failures/min, > 10× normal traffic on a single IP, etc. Tune thresholds via the Settings sub-page (defaults are sensible for most apps).

Users (sub-page)#

• Signup curve — cumulative + per-day.
• Active users — DAU, WAU, MAU rolled up. The MAU figure is what your billing uses (see Billing → MAU).
• Retention — cohort grid: signups in week N, active in weeks N+1, N+2, ….
• Email-verification rate — what fraction of signups verify within 24h / 7d / 30d.

Auth Methods (sub-page)#

Stacked bar over time:

• Password
• Magic Link
• OAuth (split per provider — Google, Microsoft, GitHub, Apple)
• Passkey
• SAML SSO

Read it as a "what should I prioritize" diagnostic. If 90% of sign-ins are via password and only 2% via passkey, and you've enabled passkey for a month, the passkey CTA isn't visible enough on Authaz Sign-In.

API equivalent#

# Authentication activity
curl 'https://your-app.authaz.io/api/v1/applications/{appId}/analytics/auth-activity?days=30' \
  -H "X-API-Key: $AUTHAZ_API_KEY"
 
# Signups
curl 'https://your-app.authaz.io/api/v1/applications/{appId}/analytics/signups?days=30' \
  -H "X-API-Key: $AUTHAZ_API_KEY"
 
# Security
curl 'https://your-app.authaz.io/api/v1/applications/{appId}/analytics/security?days=30' \
  -H "X-API-Key: $AUTHAZ_API_KEY"
 
# Auth method breakdown
curl 'https://your-app.authaz.io/api/v1/applications/{appId}/analytics/methods?days=30' \
  -H "X-API-Key: $AUTHAZ_API_KEY"

Responses are pre-aggregated daily — small enough to plot directly in your own dashboards if you want to embed them in your product's admin UI.

Latency expectations#

• Charts on the Overview page render in < 500 ms typically.
• 30-day windows are pre-aggregated; 90-day and custom ranges may take a couple of seconds the first time then cache.
• The MAU figure updates hourly.

If you see a chart loading for more than ~10 seconds, something's off — refresh the page; the API has a 30-second timeout on these queries.

Practical tips#

• Bookmark the Security page if you're on-call for security incidents. The first signal of a credential-stuffing run shows up there 5–15 minutes before your support inbox.
• Treat MAU as a leading indicator, not a billing surprise. If MAU is climbing faster than expected, you're either growing well or someone's automating signups. Look at Auth Methods to see which.
• Cohort retention reveals onboarding issues. Steep drop from week 1 → week 2 means the post-signup experience isn't sticking.

Next steps#

• Audit Logs — every individual action, not just aggregates.
• Authentication — adjust policies based on what the analytics show.
• Users — drill from a chart to specific accounts.