> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/cryptographic-token-pki/integration-workflow/user-presence.md).

# User Presence

The user's mobile device and servers interact over APIs. To prevent unauthorised access from non-trusted devices, partners should use the mobile CDK and ensure all requests to servers are signed. Signed requests from a mobile device guarantee the authenticity of the trusted mobile device. In certain scenarios where user presence is required, such as accepting contracts or performing high-value transactions, VIDA provides APIs that sign the payload once the user is locally validated. Users can verify their presence using fingerprints, iOS Face IDs, or app passwords. The mobile CDK validates user authentication attributes using the device's local data.

{% hint style="info" %}
VIDA maintains the user identity verification records along with their government ID document. If interested, a partner can also perform a user presence validation against such identity using VIDA face auth.
{% endhint %}

### Registration Workflow:

#### **User Presence Options**: 

VIDA offers different user presence options during registration: 

* SILENT\_USER: Messages are signed silently without user presence verification. 
* ENFORCE\_USER\_PRESENCE: User presence is required, and authentication attributes (password or biometrics) are used for signing. 
* SILENT\_AND\_ENFORCE\_USER\_PRESENCE: Both silent signing and user presence verification are supported.

#### **User Password Input:**

 During device registration, the partner mobile app collects the user's password based on the application's security policy. 

  Here are some examples: 

* The user may need to enter the password twice to eliminate the possibility of typing in an incorrect password.
* The user can view the password as it is being typed

The password is provided to the `RegisterDevice` call to enable user presence.

{% hint style="info" %}
Refer to the following workarounds, if a partner mobile app does not want to expose an additional application password. 

* The partner mobile app can generate a random password value internally and input the same to the registerDevice call. However, storing secrets in a mobile app can be vulnerable. A secured trusted vault of the mobile platform is recommended for the same. 
* The partner mobile app can configure the biometric-based device screen locking mechanism to verify the user presence.
  {% endhint %}

#### Biometric Verification: 

To enable the user presence with the device’s local biometric-based verification, the device must be set up for screen lock with either Face ID or Touch ID on iOS platforms or equivalent biometric technologies on the Android platforms. The configured device PIN can act as a fallback when biometric authentication fails. The partner mobile app invokes the `enableBiometrics` to activate the CDK for user presence with the device’s local biometric verification.

### Signing Workflow:

#### Biometric Authentication:

If biometric authentication is enabled, the mobile application invokes the `signMessageWithUserPresence` call, prompting users to provide their biometric information for message signing.

#### App Password: 

If biometric authentication is not available, the mobile app prompts users to enter the application-specific password. The collected password is then sent to the signMessageWithUserPresence call for signing.

#### Password Change:

1. Old Password Verification: When changing the password, the old password must be provided before configuring a new password.
2. Disabling Biometric Verification: Changing the password disables user presence with device native biometry. Users will be prompted again to activate the biometry workflow.
3. Password Recovery: In case of forgotten passwords, there is an optional function to wipe the partner mobile app data without a password, rendering password-protected credentials unusable but still securely stored.

### Supported platforms 

| Type    | Operating System    | Platform API     |
| ------- | ------------------- | ---------------- |
| Android | Lollipop and higher | 23 and higher    |
| iOS     | 13 and higher       | Bitcode disabled |