> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/biometric-device-selfie-id/integration-methods/selfie-id-api/authentication.md).

# Authentication

The authentication process for multi-factor authentication in VIDA involves the following steps:

**1. Triggering Authentication**

* The **partner app** initiates the Selfie ID validation workflow when required, such as:
  * A high-value transaction
  * A sensitive action (e.g., e-prescribing by a doctor)
  * Step-up authentication for increased security

**2. Request for Authentication**

* The **app makes an API request** to the **partner backend**, which then forwards it to the **VIDA Authentication Server**.
* The request includes the **Credential ID** associated with the user.

**3. Challenge Presentation**

* The **VIDA Authentication Server** responds with a **Face Capture Challenge**.
* The **app launches the device camera** to capture a **selfie for biometric validation**.

**4. Response Submission**

* The **app submits the captured selfie** to VIDA via an API call for biometric validation.

**5. Response Authentication**

* VIDA Authentication Services **validate the submitted biometric data** using **liveness detection and face matching** against the registered **Credential ID**.

**6. Success Status and Additional Claims**

* If the authentication is **successful**, VIDA returns:
  * **Success status**
  * **Match score**
  * **Additional configured metadata (if applicable)**

**7. Signed Assertion**

* VIDA generates a **signed assertion** that includes:
  * **Credential ID**
  * **User email**
  * **Phone number (if applicable)**
  * **Success score and other claims**

**8. Postback Submission to Partner Backend**

* The **VIDA Authentication Server** sends the signed assertion to a **predefined postback URL** on the **partner backend**.

**9. Processing the Authentication Result**

* The **partner backend extracts the validation result** and **grants or denies access** based on the authentication outcome.

{% hint style="info" %}

1. The workflow is a simplified representation only. The details of the information exchanged varies based on the credential type and the authentication protocol used. 
2. Claims are optional and depend on the type of authenticator used to validate.
3. The nature of workflow GET vs POST is partner application driven.
4. In the case of Face Match, no credential ID will be provided for authentication. A template image URL will be provided.
5. In the case of Credential Services based Authenticators, the credential services workflow is used for provisioning. The credential ID obtained can be used in the VIDA Authentication Server for validation.
   {% endhint %}

In case of an error, the VIDA authentication services presents the error code and messages to a pre-configured redirect URL for the final rendering at the partner server. The details are presented in the integration steps