Our Android SDK offers the easiest way to integrate "Sign in with device" to your android app. You can simply call a function and it does most of the heavy lifting and authentication for you.
Overview
Authenticating users using Trusted Devices with Cotter's Android SDK consists of the following steps:
1.
Import and Initialize Cotter
2.
Calling functions to register devices a Trusted Device
3.
Calling functions to authenticate from Trusted and Non-Trusted Device
Step 5: Register this device as a Registered Device
Right after your user finished their registration to your app, you should automatically register the device as a Trusted Device (or prompt your user if they want to make this device as a Trusted Device).
"ID":"746500ae-a5cd-4692-8fd0-49d57cf7cc57",// User ID from Cotter's system
3
"created_at":"2020-02-25T04:08:26.174597Z",
4
"update_at":"2020-02-27T22:20:31.333154814Z",
5
"deleted_at":null,
6
"issuer":"afcabd98-745f-4b9e-98de-af968d9951d3",// your API KEY ID
7
"client_user_id":"1014",// you client's user ID
8
"enrolled":[// Enrolled Authentication Methods
9
"PIN",
10
"BIOMETRIC",
11
"TRUSTED_DEVICE"// This should be added to enrolled methods once enrollDevice successful
12
],
13
"default_method":"TRUSTED_DEVICE"// This will automatically be the last enrolled method, which is Trusted Device in this case
14
}
Copied!
This method is only for the first Trusted Device. You will get an error if you attempt to enroll another Trusted Device using enrollDevice when there's already a Trusted Device for the account. To enroll other devices, see Add a new Trusted Device.
Step 6: Authenticate from a Trusted Device
To authenticate a device, call the TrustedDeviceHelper.requestAuth function. This will automatically detect whether the current device is a Trusted Device or not.
event: A name to identify the event action type, like "LOGIN" or "TRANSACTION".
callbackClass : The next activity class that you want to redirect to when the authentication request is finished
callback : A custom Callback function that implements 2 methods: onSuccess and onError.
When an Authentication Event is requested using method TRUSTED_DEVICE, there are 2 possible cases:
Case 1: The current device is a Trusted Device
If the current device is a Trusted Device, it should automatically be approved, and you will receive a JSON result containing the requested Event and whether or not it's approved. The approval is based on whether or not the signature included in the request from the SDK is valid.
1
{
2
...
3
"method":"TRUSTED_DEVICE",
4
"new":false,// Is this a new pending event (should be false).
5
"approved":true,// Is this event approved (should be true).
6
7
"oauth_token":{
8
"access_token":"eyJhbGciOiJFUz...",// validate this access token
9
"id_token":"eyJhbGciOiJFUz...",
10
"refresh_token":"5:cYIfabtspE1cBeD7KP...",
11
"expires_in":3600,
12
"token_type":"Bearer",
13
"auth_method":"TRUSTED_DEVICE"
14
}
15
}
16
Copied!
You should see a result that the event is not new, and that it's approved. This is because the signature from the Trusted Device is sufficient to prove that the device is authorized.
When passing this Response to your backend, you need to check if this JSON is valid and if it comes from Cotter's server by validating the access token.
Checkout how to verify the OAuth Tokens from Cotter here: