Skip to content

Authenticate with mobile biometrics

Request

Completes authentication in Transmit. Before calling this API, invoke the client-side SDK provided by Transmit to sign a challenge using the private key stored by the device, which only occurs after the user verifies themselves with biometrics. Returns an access token for the user associated with the key.

Security
ClientAccessToken
Bodyapplication/jsonrequired
One of:
resourcestring

Resource URI the authentication request is attempting to access, which is reflected in the audience (aud claim) of the access token. This must be configured as resource for the application.

claimsobject

Used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the OIDC Standard. For supported claims and how to request custom claims, see the ID Token Reference.

Example:
{
  "id_token": {
    "roles": null
  }
}
org_idstring

Organization ID, used for member login in B2B scenarios

client_attributesobject

Client attributes

device_idstring, <= 80 characters

Identifier of the device from which the authentication request originates

session_idstring

Used to associate the authentication with an existing session (such as for MFA). If unspecified, a new session is created and the session ID is returned.

signaturestringrequired

Signed challenge returned by SDK authentication call

challengestringrequired

A string used to create attestation

key_idstringrequired

ID of the key

identifierstringrequired

User identifier, which may correspond to the user's email, phone number, username, or user ID. The type of identifier should be specified as the identifier_type.

identifier_typestringrequired

Type of user identifier used for login

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/mobile-biometrics/authenticate \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "resource": "string",
    "claims": {
      "id_token": {
        "roles": null
      }
    },
    "org_id": "string",
    "client_attributes": {
      "user_agent": "string",
      "ip_address": "string"
    },
    "device_id": "string",
    "session_id": "string",
    "signature": "string",
    "challenge": "string",
    "key_id": "string",
    "identifier": "string",
    "identifier_type": "string"
  }'

Responses

Returns user tokens

Bodyapplication/json
access_tokenstringrequired

User access token for accessing endpoints on behalf of the authenticated user.

id_tokenstring

ID token that identifies the user.

refresh_tokenstring

Refresh token used to refresh an expired access token.

token_typestringrequired

Bearer.

expires_innumberrequired

Expiration time of the access token in seconds.

Default:3600
session_idstringrequired

ID of the session in which the authentication occurs.

signing_artifactsApiPasskeySigningArtifactsDto (object) or ApiCryptoKeySigningArtifactsDto (object)
One of:

Cryptographic data required to independently verify a transaction approval outside Mosaic. Returned when approval_data is provided for a supported transaction-signing flow; fields vary by authenticator.

Response
{
  "access_token": "string",
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string",
  "expires_in": 3600,
  "session_id": "string",
  "signing_artifacts": {
    "approval_data": { … },
    "public_key": "string",
    "signature": "string",
    "credential_id": "string",
    "webauthn_session_id": "string",
    "authenticator_data": "string",
    "client_data_json": "string",
    "raw_challenge": "string"
  }
}