Built for the people who get asked what a transaction actually did.
- Protocol operations
- Forensic investigators
- Compliance analysts
- Incident responders
50+
mainnets you can ingest
150+
protocols with decoding definitions
50
built-in grouping recipes
61
Terraform resources
The workspace
From one transaction to a standing watch
Three screens from the Authe dashboard, shown here with sample data.
Investigate
Follow the money hop by hop
Start from a hash or an address. A tracer walks value flows up to eight hops out, crosses bridges onto the next chain, and stops where the public trail ends, such as an exchange deposit, with the reason on the graph. Recorded transfers and estimated allocations are drawn differently, so the graph never claims more than the chain shows.
- Semantic, flow and raw views of every transaction
- Recorded and estimated edges kept visibly apart
- Graphs saved to a case or shared by expiring link
Analyze
Search decoded activity like logs
The analytics explorer works like log search, over decoded transactions instead of log lines. Filter on any decoded field, promote the useful ones to facets, and pin the result to a dashboard. The URL holds the whole query, so a colleague opens exactly what you saw.
- Filter chips over decoded fields and facets
- Dashboards built from explorer panels
- CSV, Excel and JSON exports, each one logged
Automate
Alert rules that see the decoded transaction
A pipeline is a graph of steps: ingest, decode, enrich, group, evaluate rules, deliver. Start from one of 18 templates or build your own. Rules run after the enrichments they depend on, so they can match a decoded field or a risk score. When a block is reorganised away, alerts raised from it are voided.
- Pipeline builder with templates and dry runs
- Grouping and reorg detection as pipeline steps
- Slack, signed webhooks, email, SNS and in-app
Cross-chain investigations
Investigations that don't stop at the bridge
Authe groups the legs of a bridge transfer by the identifier the protocol itself carries: the CCIP message ID, the Wormhole VAA, the LayerZero packet, the CCTP burn message. Here, one Ethereum transaction sent two CCIP messages.
01 · Source
Ethereum
Message sent through the CCIP router
OnRamp · CCIPMessageSent
finalized
02 · Destination
Base
Same message ID, executed
OffRamp · ExecutionStateChanged
confirmed
03 · Destination
Arbitrum
No execution seen yet
awaiting OffRamp event
not observed
A leg Authe has not seen is shown as not observed. That is a statement about our data, not a claim that the message failed.
Integrations
Alerts and data go where your team already works
Send alerts to Slack, signed webhooks, email or SNS. Read and write the same data over REST or GraphQL, and manage the workspace with the Terraform provider.
- SlackAlert channels
- WebhooksHMAC-signed
- EmailTeam inboxes
- SNSAWS fan-out
- TerraformWorkspace as code
- REST & GraphQLYour own tools
For engineers
Keep monitoring in code review
The Terraform provider covers 61 resources, including pipelines, tracers, alert rules, destinations, grouping rules and evidence policies. A new rule is a pull request, not a settings change nobody can trace. Runs accept transaction hashes or block ranges, and every decoded fact, catalog entry and grouping is available over REST and GraphQL. API keys come with Pro.
resource "authe_destination" "oncall" {
name = "oncall-slack"
kind = "slack"
config = { url = var.slack_webhook_url }
}
resource "authe_trigger" "treasury_outflow" {
name = "treasury-outflow"
scope = "tenant"
severity = "high"
chain_ids = ["eip155:1", "eip155:8453"]
cooldown_seconds = 300
condition = jsonencode({
all = [
{ field = "canonical.from_address", operator = "eq", value = var.treasury },
]
})
destination_ids = [authe_destination.oncall.id]
}Uses the authe Terraform provider. API keys are available on Pro and Enterprise.
Why Authe
Keep the evidence behind every conclusion
Authe shows its working: where a finding came from, how it was linked, and how sure the platform is.
Recorded facts and estimates stay apart
Every edge, link and label shows where it came from and how sure Authe is about it.
Bridge legs matched on the bridge's own IDs
Source and destination transactions are grouped by the identifier the protocol itself uses.
Cases that hold up to review
Transactions, graphs, notes and annotations live in one shared case.
A finding becomes a watch
Save the query, watch the addresses, and send alerts to wherever your on-call already looks.
Paired US regions
Oregon and N. Virginia back each other up
Team roles
Built-in roles, custom roles on Pro
Managed sign-in
Auth0 accounts and organisations
Audit log
Who changed what, and when
See how it fits your workflow
Inspect a sample investigation now, or find a tailored demo for your network, organization and investigation needs.