> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/cryptographic-token-pki/phone-token.md).

# Phone Token

The **VIDA Phone Token** is at the core of VIDA’s authentication solutions, offering unparalleled security by leveraging device binding-based cryptographic keys and Public Key Infrastructure (PKI). It ensures that only authorized and trusted devices can initiate and verify transactions, protecting platforms against unauthorized access and fraud.

<figure><img src="/files/IWa8xtmrwwMzJVuZ9ecO" alt=""><figcaption></figcaption></figure>

### **Phone Token Registration**

#### **Device Registration & Key Pair Generation**

1. The Partner System requests to register the user in the VIDA Authentication Server.
2. VIDA generates an **Unbound Credential ID** and returns it to the Partner System.
3. The **VIDA Credential Development Kit (CDK)**, integrated into the mobile app, generates a cryptographic key pair.
   1. The private key is securely stored in the device’s hardware-backed keystore.
   2. The public key is sent to the VIDA authentication Server

#### **Secure Key Registration**

4. VIDA **associates the public key** with the **Credential ID** and stores it in a secure **directory of registered public keys**.
5. This ensures that only the registered device can sign **authentication requests** and **transactions**.
6. The **Partner System** is notified of **successful registration**, enabling device-based authentication for future transactions.

***

### **Phone Token Verification & Usage**

1. **Transaction Signing & Verification**
   * When a user initiates a transaction, the Partner System requests VIDA to authenticate it using the Phone Token.
   * The transaction message is signed locally on the user’s device using the **private key**.
   * VIDA validates the signed transaction by checking its authenticity against the stored **public key**.
   * If the validation is successful, VIDA approves the transaction.
2. **User Presence & Additional Security Layers**
   * Depending on configuration, user presence can be required for signing, such as:
     * **Biometric authentication** (e.g., fingerprint, Selfie ID)
     * **Application PIN/password**
   * This ensures an additional layer of security, preventing unauthorized access.

{% hint style="info" %}

* The term password used here represents all kinds of password-like entities, namely, application password, application personal identification number (PIN), etc.&#x20;
* The CDK does not provide any configurable policies around controlling the length and formats of the password. However, application developers can define and impose such restrictions for a better user experience.
  {% endhint %}