> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/introduction/authentication-workflow.md).

# Authentication Workflow

VIDA ensures a secure and seamless authentication process through a structured **registration and validation workflow**. During registration, a **unique Credential ID** is generated and linked to the user’s device and authentication factors. 

This Credential ID is then used to validate and authorize future transactions, enhancing security and trust.

### **Credential ID Generation**

1. To initiate authentication, the **Partner System** (such as a web application, backend service, or mobile app)  sends an Credential ID setup request.
2. The **Partner Backend Server** forwards this request to the **VIDA Authentication Server**.
3. VIDA generates an **Unbound Credential ID** (not yet associated with any authentication factor).
4. This **Credential ID** is returned to the **Partner Backend Server,** and relayed to the originating system.
5. The **Credential ID** serves as a unique identifier for linking authentication factors such as a **Device Token (Phone Token)** or **Selfie ID based authentication.**

### **Authentication Method Registration**

Once the **Credential ID** is generated, authentication methods can be linked to it.

1. The Partner System registers an authentication factor using the assigned Credential ID.
2. VIDA securely associates the authentication factor, ensuring validation and integrity.
3. Authentication methods include:
   * **Phone Token**: A cryptographic key pair is generated, where the private key is securely stored on the device, and the public key is sent to VIDA. VIDA binds the Credential ID to the device, completing registration.
   * **Selfie ID**: The user undergoes biometric verification through a liveness check. Upon successful validation, VIDA securely links Selfie ID to the Credential ID.
4. Upon successful registration, the authentication factor is bound to the **Credential ID**, allowing secure authentication for future transactions.

### **Transaction Initiation & Validation**

Once authentication factors are successfully registered, users can initiate and validate transactions.

1. The user initiates a transaction in the Partner System.
2. VIDA verifies the authentication factor linked to the Credential ID.
3. Depending on the authentication method, secure validation is performed
   * **Phone Token**: The transaction is digitally signed using a cryptographic signature tied to the registered device. VIDA verifies the signature and ensures the Device Token is associated with the correct Credential ID.
   * **Face Token**: The user completes a liveness check, and VIDA validates the Selfie ID against the stored biometric data before approving the transaction.
4. If validation is successful, the transaction is approved; otherwise, it is rejected.