Authenticate from a Non-Trusted Device
Last updated
Last updated
There are 2 steps in authenticating a Non-Trusted Device
from the Non-Trusted Device and wait for approval. The SDK will automatically show a prompt asking the user to approve this request from the Trusted Device.
from a Trusted Device. The user should tap a button to check if there's a login request. They can then approve or reject the login request.
When the login request is approved, the Non-Trusted Device will receive oauth_tokens
. You should validate these tokens in your backend.
When an Authentication Event is requested using method TRUSTED_DEVICE
, there are 2 possible cases:
If the current device is not a Trusted Device, then it will create a pending event. This pending event will need to be approved by a Trusted Device.
To check if there's a pending event for this user, you can call the getNewEvent
method from a Trusted Device.
For now, you should tell your user to press a button and invoke this method when they try to login from a non-trusted device.
The SDK will open a prompt in the Trusted Device asking if the user want to approve or reject the authentication request
You should pass the access_token
to your backend when logging-in users, approving transactions, etc. Learn how to validate the access token:
Same as how it works with , to authenticate a device, call cotter.signInWithDevice
. This will automatically detect whether the current device is a Trusted Device or not.
You will be automatically approved if the request is coming from a Trusted Device. This is covered in .
In the prompt in the user's Non-Trusted Device (right picture), you can to ask them to press a specific button in the Trusted Device to invoke the prompt on the left.
When the user approved the login request in the Trusted Device, your onSuccess
function in the authentication request in will be invoked and will receive a JSON response with an access token: