Mobile App authentication
Keyri enables true passwordless authentication in mobile apps using cryptographic credentials, which are embedded into your users' devices by the Keyri mobile SDKs, and, optionally, phone biometrics or PIN. It is a simple and secure way to authenticate users in your mobile app without the need for memorizing passwords or typing unreliable SMS OTP codes and can be used for primary, secondary, and continuous authentication in the background. When used in conjunction with biometrics, it constitutes MFA in that it presents evidence of what the user has (the device containing their cryptographic credentials) and what the user is (their biometrics).
How it Works: User + Mobile Device Signatures
Keyri's mobile SDKs include ECDSA (opens in a new tab) methods that allow you to tie an individual account to a specific device. These methods associate a signing key pair to an account.
The public key should be saved in your user credentials database. The private key is persistent on and non-extractable from the device on which it was generated. It is used to generate cryptographic signatures for a given account that can then be validated by your backend application using the user's public key.
Example
let keyri = KeyriInterface(appKey: appKey, publicApiKey: publicApiKey, serviceEncryptionKey: serviceEncryptionKey)
func login(username: String) async throws { let loginObject =
keyri.login(publicUserId: username)
authService.login(urlSuffix: "api/login", body: loginObject)
}
func register(username: String) async throws { let registerObject =
keyri.register(publicUserId: username)
authService.register(urlSuffix: "api/register", body: registerObject)
}
func makeAuthApiCall(urlSuffix: String, body: [String: Any]) {
guard let url = URL(string: BASE_URL + urlSuffix) else {
print("Can't parse request URL:\(urlString)")
return
}
var request = URLRequest(url: url)
request.httpMethod = "POST"
request.httpBody = body
URLSession.shared.dataTask(with: request) { data, response, error in
// Process result
}.resume()
}
Backend Setup
Configure an API endpoint to receive the data returned by the SDK register
and
login
methods from your app. For the data returned by register
, you should
store the public key in your user credentials database. For the data returned by
login
, you should verify the signature using the public key associated with
the user's account.
The backend setup for passwordless authentication in your mobile app is the same as that for server-side QR login. See documentation here for a Node.js example.