> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/password-api.md).

# Password API

The **Password-based authentication method** offers a traditional yet secure approach to user verification by enabling credential provisioning and validation through password-based flows. 

This method is ideal for scenarios where device-based cryptographic tokens are not available or where simpler credential models are required without compromising security.

### **Transaction Initiation**

Every authentication or provisioning session begins with a transaction initiation request. The server responds with:

* A unique **Session ID**
* A **user challenge**
* A **bearer token**
* A **follow-up URI** to complete the transaction

This ensures that every password exchange happens within a securely scoped and time-bound session.

### **Provisioning**

In the case of password provisioning:

* The client initiates provisioning using the transaction initiation response.
* The user selects a password and submits it to the **follow-up URI**.
* The server securely stores the credential and links it to the user identity.

**3. Authentication / Transaction Completion**

To authenticate:

* The client submits the challenge response (i.e., password) to the follow-up URI.
* The VIDA Authentication Server verifies the password and, if valid, returns an **access token** to complete the session.