# Authenticate from a Non-Trusted Device
There are 2 steps in authenticating a Non-Trusted Device
1. [Make a request](#step-1-making-an-authentication-request) from the Non-Trusted Device and wait for approval
2. [Approve the request](#step-2-how-to-approve-a-pending-request-from-a-trusted-device) from a Trusted Device.
## Step 1: Making an Authentication Request
Same as how it works with [Authenticating from a Trusted Device](https://docs.cotter.app/sdk-reference/android/sign-in-with-device), to authenticate a device, call the `TrustedDeviceHelper.requestAuth` function. **This will automatically detect whether the current device is a Trusted Device or not.**
{% tabs %}
{% tab title="Java" %}
```java
Cotter.signInWithDevice(this, userEmail, this, Dashboard.class, new Callback() {
@Override
public void onSuccess(JSONObject result) {
Toast.makeText(getApplicationContext(), result.toString(), Toast.LENGTH_SHORT).show();
Log.e("Success authenticating user", result.toString() );
}
@Override
public void onError(String error) {
Toast.makeText(getApplicationContext(), error, Toast.LENGTH_SHORT).show();
}
});
```
{% endtab %}
{% tab title="JSON result" %}
```javascript
{
"ID": 1361, // Event ID
"CreatedAt": "2020-02-27T22:22:48.705212512Z",
"UpdatedAt": "2020-02-27T22:22:48.705212512Z",
"DeletedAt": null,
"client_user_id": "abcdefgh-abcd-abcd-abcd-af968d9951d3", // your user's Cotter User ID
"issuer": "YOUR API KEY ID", // your API Key
"event": "LOGIN",// requested event (LOGIN, or TRANSACTION, etc)
"ip": "192.168.232.2",
"location": "Unknown",
"timestamp": "1582842167",
"method": "TRUSTED_DEVICE", // auth method: TRUSTED_DEVICE (other choices are PIN / BIOMETRIC)
"new": false, // Is this a new pending event. More explanation below about Non-Trusted Device
"approved": true // Is this event approved.
// If authentication successful:
// Validate the oauth_token.access_token
"oauth_token": {
"access_token": "eyJhbGciOiJFUz...", // validate this access token
"id_token": "eyJhbGciOiJFUz...",
"refresh_token": "5:cYIfabtspE1cBeD7KP...",
"expires_in": 3600,
"token_type": "Bearer",
"auth_method": "TRUSTED_DEVICE"
}
}
```
{% endtab %}
{% endtabs %}
#### Callback Class
The `Callback.class` should be filled with the Activity to go to when the request is approved. For example, if this is a login request, then the Callback Activity can be your Dashboard class.
When an Authentication Event is requested `TRUSTED_DEVICE`, there are 2 possible cases:
### Case 1: The current device is a Trusted Device
You will be automatically approved if the request is coming from a Trusted Device. This is covered in [Authenticate from a Trusted Device.](https://docs.cotter.app/sdk-reference/android/sign-in-with-device)
### Case 2: The current device is NOT a Trusted Device
If the current device is **not** a Trusted Device, then it will create a **pending event.** This pending event will need to be **approved by a Trusted Device**.
The SDK will automatically show a prompt for the user to approve the event from a Trusted Device. The user then need to approve this request from their Trusted Device:
## Step 2: How to approve a pending request from a Trusted Device
To check if there's a pending event for this user, you can call the `getNewEvent` method from a Trusted Device.
{% tabs %}
{% tab title="Java" %}
```java
TrustedDeviceHelper.getNewEvent(getApplicationContext(), this);
```
{% endtab %}
{% endtabs %}
{% hint style="info" %}
**In the future,** your app that is installed in a Trusted Device will receive a notification and this method is invoked when the notification is opened.
{% endhint %}
**For now,** you should **tell your user to press a button and invoke this method** when they try to login from a non-trusted device.
The SDK will open a prompt in the Trusted Device asking if the user want to approve or reject the authentication request.
In the prompt in the user's Non-Trusted Device (right picture), you can [Customize the Prompt](https://docs.cotter.app/sdk-reference/android/sign-in-with-device/customization) to ask them to press a specific button in the Trusted Device to invoke the prompt on the left.
## Receiving the result and check if the request was approved
**In the non-trusted device** where the user is trying to log in, you'll receive the result in the callback class that your specified.
### Case 1: The request is approved
When the request is approved, the SDK will automatically redirect to your Callback Class. In the callback class, you should handle the response from Cotter
#### Handle the response in your callback class
```java
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_dashboard);
// Handle the response
TrustedDeviceResponse trustDevResp = TrustedDeviceHelper.handleResponse(getIntent());
if (trustDevResp != null) {
Log.i("TrustedDeviceResponse: ", Integer.toString(trustDevResp.event.ID));
}
}
```
You'll receive a response in the form of a `TrustedDeviceResponse` object.
{% tabs %}
{% tab title="Java" %}
```java
public class TrustedDeviceResponse {
public String response; // The response in the form of a string
public Event event; // The same response, but parsed in to an Event object
public boolean approved; // Whether or not the event was approved
public String error; // If there's any error, this will contain the error, otherwise null
}
```
{% endtab %}
{% tab title="String Response" %}
```javascript
{
"ID": 1364,
"CreatedAt": "2020-02-28T00:08:52.715136Z",
"UpdatedAt": "2020-02-28T00:08:56.917318Z",
"DeletedAt": null,
"client_user_id": "abcdefgh-abcd-abcd-abcd-af968d9951d3", // user's cotter user id
"issuer": "YOUR API KEY ID",
"event": "LOGIN",
"ip": "10.0.2.15",
"location": "",
"timestamp": "1582848531",
"method": "TRUSTED_DEVICE",
"new": false, // Should now be false because the Trusted Device already responded
"approved": true // In this case 1, this should be true. Otherwise your Callback class won't be open
// If authentication successful:
// Validate the oauth_token.access_token
"oauth_token": {
"access_token": "eyJhbGciOiJFUz...", // validate this access token
"id_token": "eyJhbGciOiJFUz...",
"refresh_token": "5:cYIfabtspE1cBeD7KP...",
"expires_in": 3600,
"token_type": "Bearer",
"auth_method": "TRUSTED_DEVICE"
}
}
```
{% endtab %}
{% endtabs %}
When this authentication request is approved, you'll receive an access token in the **String Response**. Send this access token to your backend to validate it:
{% content-ref url="../../../getting-access-token/verifying-jwt-tokens" %}
[verifying-jwt-tokens](https://docs.cotter.app/getting-access-token/verifying-jwt-tokens)
{% endcontent-ref %}
### Case 2: The request is rejected
If the request is **not approved** for 1 minute, the prompt in the Non-Trusted Device will show an error message. The prompt will not show an error immediately when the Trusted Device denied the request, i.e. there is no difference between rejection and no response from the Trusted Device.
In this case, the [`onError` function that you passed in earlier](#step-1-making-an-authentication-request) will be called with an error message of `Event is not approved`.