Authentication

The authentication process for multi-factor authentication in VIDA involves the following steps:

1. Triggering Authentication

• The partner app initiates the Selfie ID validation workflow when required, such as:

  • A high-value transaction

  • A sensitive action (e.g., e-prescribing by a doctor)

  • Step-up authentication for increased security

2. Request for Authentication

• The app makes an API request to the partner backend, which then forwards it to the VIDA Authentication Server.

• The request includes the Credential ID associated with the user.

3. Challenge Presentation

• The VIDA Authentication Server responds with a Face Capture Challenge.

• The app launches the device camera to capture a selfie for biometric validation.

4. Response Submission

• The app submits the captured selfie to VIDA via an API call for biometric validation.

5. Response Authentication

• VIDA Authentication Services validate the submitted biometric data using liveness detection and face matching against the registered Credential ID.

6. Success Status and Additional Claims

• If the authentication is successful, VIDA returns:

  • Success status

  • Match score

  • Additional configured metadata (if applicable)

7. Signed Assertion

• VIDA generates a signed assertion that includes:

  • Credential ID

  • User email

  • Phone number (if applicable)

  • Success score and other claims

8. Postback Submission to Partner Backend

• The VIDA Authentication Server sends the signed assertion to a predefined postback URL on the partner backend.

9. Processing the Authentication Result

• The partner backend extracts the validation result and grants or denies access based on the authentication outcome.

1. The workflow is a simplified representation only. The details of the information exchanged varies based on the credential type and the authentication protocol used.

2. Claims are optional and depend on the type of authenticator used to validate.

3. The nature of workflow GET vs POST is partner application driven.

4. In the case of Face Match, no credential ID will be provided for authentication. A template image URL will be provided.

5. In the case of Credential Services based Authenticators, the credential services workflow is used for provisioning. The credential ID obtained can be used in the VIDA Authentication Server for validation.

In case of an error, the VIDA authentication services presents the error code and messages to a pre-configured redirect URL for the final rendering at the partner server. The details are presented in the integration steps