Device auth

Device auth uses public key cryptography to securely authenticate users. This approach requires a capable device, such as an iOS or Android smartphone, to create a cryptographic key pair. The private key remains securely stored on the user’s device, while the public key is used to verify the user’s identity by verifying digital signatures.

This authentication method is useful in scenarios where:

• A possession factor is required to authenticate a user.
• Users are authenticated on a mobile device with a long session, and need to authenticate on a separate device with short sessions or poor input capabilities.
• Restricted actions can only be performed on specific physical devices.

​

Use cases

​

Approve a push notification sent to a mobile device

• Send a notification to a phone to approve/deny an action performed on a website.

​

Scan a QR code

• Log into a desktop or web application from an application that is typically used on mobile.
• Identify a user on a kiosk in a quick service restaurant (QSR) to load loyalty programs, rewards and offers.
• Log into an application running on a TV.
• Complete a payment via a terminal.

​

Adding server side validation to a device action

• Verify that a high risk action is performed on a trusted device.

​

Implementation

​

Register a device

Before users can receive and complete device challenges, they must first enroll their device by adding device credentials through the mobile SDK. This one-time setup creates the cryptographic keys needed for secure authentication.

​

Choose your use case

Select an option below to see further implementation details for your use case.