Trusted device

Device auth is a simple way to verify that a high risk action is performed on a trusted device.

​

Prerequisites

• Users must have a device that they can use to complete the challenge. This can be done by adding device credentials via our mobile SDK.

​

Sequence

​

Implementation

​

1. Track an action (optional)

Skip to step 2 if you don’t need to run rules on the action for adaptive MFA or want to associate additional data with the action through the custom data field.

Track an action from your backend using our Server SDK or Server API.

Return the state and token to your mobile app. On your mobile app, check the state parameter to conditionally challenge the user. If the state is CHALLENGE_REQUIRED, call the setToken method to set the token.

if (response.state === "CHALLENGE_REQUIRED") {
  await authsignal.device.setToken(response.token);
} else if (response.state === "ALLOW") {
  // Allow the user to continue
} else if (response.state === "BLOCK") {
  // Block the user from signing in
}

​

2. Verify the device (Mobile)

Use our Mobile SDK to verify the device.

If the device credentials were created without using the userAuthenticationRequired flag, you may optionally present your own challenge dialog such as a PIN screen prior to calling the verify method.

If the device credentials were created using the userAuthenticationRequired flag, the OS will present the challenge dialog upon calling the verify method. To learn more, see our Device SDK documentation.

const response = await authsignal.device.verify();

​

3. Validate the challenge (Backend)

Once the user has completed the challenge, pass the token returned from the previous step to your backend. Your backend should call the validate challenge API to validate the challenge.