> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/biometric-device-selfie-id/face-token.md).

# Face Token

The **VIDA Face Token** builds on the robust security foundation of the **VIDA Phone Token** by incorporating biometric authentication, adding an extra layer of protection through **liveness detection** and **face matching**. This ensures that transactions are not only bound to a trusted device but also to the rightful owner’s **verified facial identity**.

By leveraging **device-based cryptographic keys, Public Key Infrastructure (PKI), and biometric validation**, the **VIDA Face Token** offers an advanced authentication mechanism that protects against **unauthorized access, credential compromise, and identity fraud**.

<figure><img src="/files/AwmUXrKxHQL2GHQUcIUy" alt=""><figcaption></figcaption></figure>

The process involves three key components:

### [Phone Token SDK](/identity-stack/authentication/authentication-factors/cryptographic-token-pki/integration-methods/sdk.md)

Used to generate a cryptographic key pair on the user's device. The private key is securely stored in the device's hardware-backed keystore, while the public key is registered with VIDA. This serves as a strong proof of device possession and is tied to the user’s Credential ID.

### [Passive Liveness SDK](/identity-stack/verify/liveness.md)

Integrated into the mobile app, this SDK ensures the captured selfie is from a real, live person and not a spoof (e.g., photo or video replay). It provides passive, frictionless liveness detection for seamless user experience and strong fraud resistance.

### [Selfie ID API](/identity-stack/authentication/authentication-factors/biometric-device-selfie-id/integration-methods/selfie-id-api.md)

This API suite enables biometric Selfie ID setup, authentication, and verification flows. It supports challenge-response selfie matching, Selfie ID binding, and face-based transaction approvals.

### **Face Token Registration**&#x20;

**Credential Issuance & Device Binding**

1. The **Partner System** requests a **Credential ID** from the VIDA Authentication Server.
2. VIDA generates an **Unbound Credential ID** and returns it to the Partner System.
3. The VIDA [**Phone Token SDK**](/identity-stack/authentication/authentication-factors/cryptographic-token-pki/integration-methods/sdk.md), integrated into the mobile app, generates a **Phone Token** (cryptographic key pair).
4. The **public key** is sent to VIDA for registration, while the **private key** is securely stored in the device’s hardware-backed keystore.
5. VIDA **associates the public key** with the **Credential ID** and stores it in a secure **directory of registered public keys**.

**Selfie ID Setup**

5. The user initiates **Selfie ID setup** via the mobile app.
6. The **Partner System** requests an authentication session from VIDA, and VIDA provides:
   * **Session ID**
   * **Bearer Token**
   * **Follow-up URL** for selfie upload
7. The user captures a **selfie**, which is uploaded to VIDA for processing.
8. VIDA’s [**Liveness Detection SDK**](/identity-stack/verify/liveness/integration/liveness-sdk.md) verifies the selfie to ensure the user is physically present and not using a spoofed image.
9. Upon successful verification, VIDA **binds the Selfie ID** to the **Credential ID** generated initially, completing Face Token registration.

***

### **Face Token Validation & Usage**

**Biometric Authentication & Transaction Verification**

1. When a user initiates a transaction, the **Partner System** requests VIDA to authenticate it using **Selfie ID** (along with the Phone Token).
2. VIDA generates a **unique authentication session** with:
   * **Session ID**
   * **Bearer Token**
   * **Authentication Challenge**
3. The user authenticates using **Selfie ID**, and the app submits a selfie in response to the challenge.
4. VIDA verifies the **new selfie** against the stored biometric data.
5. VIDA then **validates the signed transaction** using the stored **public key**.
6. If both checks pass, VIDA **approves the transaction**.

**User Presence & Additional Security Layers**

* Optional **multi-factor authentication (MFA)** can be enabled, which includes:
  * **Device PIN/password**
* This ensures an extra layer of **security and fraud prevention**.