{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Guides","product":"Identity Management","type":"markdown"},"seo":{"title":"Cross-device face authentication","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com/","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"cross-device-face-authentication","__idx":0},"children":["Cross-device face authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cross-device face authentication extends the standard ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face"},"children":["face authentication"]}," flow to support scenarios where users begin the login process on a desktop or laptop but perform the biometric capture on a personal mobile device. This is especially useful for users who cannot access an internal enterprise mobile application—such as contractors, interview candidates, or external partners—and must authenticate using a personal phone instead."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Important"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide builds on the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face"},"children":["Face authentication"]}," guide. Make sure you are familiar with the base flow and requirements, have installed required SDKs, and have checked prerequisites before proceeding. This guide introduces modifications to the existing journeys to enable the cross-device capability."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":1},"children":["How it works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Below are examples of registration and authentication flows."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"face-registration","__idx":2},"children":["Face registration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Face registration relies on the Identity Verification and works the same way as in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face#face-registration"},"children":["base guide"]},". If the user starts the flow in the web app, the hosted Identity Verification performs the handoff to mobile automatically."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"cross-device-face-authentication-1","__idx":3},"children":["Cross-device face authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Initiating a face authentication on a desktop:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a user requests to log in from a desktop or laptop with face authentication as a second factor, the authentication journey detects that the client is running on a non-mobile device. Instead of requesting a selfie directly, the journey creates a cross-session message and displays a QR code on the desktop screen. The journey running on a desktop waits for the mobile journey to communicate back the result. Once received, the web journey processes the message from the mobile journey and continues."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant User\n participant Desktop as Desktop client\n participant IDO as IDO SDK\n participant M as Mosaic\n\n User-->>Desktop: Log me in\n Desktop->>Desktop: Init IDO SDK\n Desktop->>IDO: Start journey\n IDO-->>IDO: Match case: detect desktop\n IDO-->>M: Create cross-session message\n M-->>IDO: Message ID (ticket)\n IDO->>Desktop: QR code (with ticket)\n Desktop-->>User: Display QR code\n note over User, M: Handoff to a mobile device\n M-->>IDO: Desktop journey resumes\n IDO-->>IDO: Authentication succeeded?\n IDO->>Desktop: Journey complete\n Desktop-->>User: Logged in\n","diagramHtml":"","diagramHtmlDark":""},"children":["sequenceDiagram\n participant User\n participant Desktop as Desktop client\n participant IDO as IDO SDK\n participant M as Mosaic\n\n User-->>Desktop: Log me in\n Desktop->>Desktop: Init IDO SDK\n Desktop->>IDO: Start journey\n IDO-->>IDO: Match case: detect desktop\n IDO-->>M: Create cross-session message\n M-->>IDO: Message ID (ticket)\n IDO->>Desktop: QR code (with ticket)\n Desktop-->>User: Display QR code\n note over User, M: Handoff to a mobile device\n M-->>IDO: Desktop journey resumes\n IDO-->>IDO: Authentication succeeded?\n IDO->>Desktop: Journey complete\n Desktop-->>User: Logged in\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Completing face authentication on mobile:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The user scans the QR code with their personal mobile device, which initiates a new instance of the journey. It detects the client and cross-session message, and performs the selfie capture. Once the selfie is acquired and validated on the mobile device, the result is communicated via the cross-session message."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant User\n participant Mobile as Mobile client\n participant IDO as IDO SDK\n participant IDV as IDV SDK\n participant M as Mosaic\n\n User-->>Mobile: Scans QR code\n Mobile->>Mobile: Init SDKs\n Mobile->>IDO: Start journey (with ticket)\n IDO-->>IDO: Match case: detect mobile + cross-session\n IDO->>Mobile: Selfie acquisition step\n IDV->>User:Capture selfie\n User->>IDV: Selfie\n IDV-->>IDO: Complete\n IDO-->>M: Selfie data\n M-->>M: Face authentication\n M-->>IDO: Complete\n IDO-->>M: Process cross-session message\n","diagramHtml":"","diagramHtmlDark":""},"children":["sequenceDiagram\n participant User\n participant Mobile as Mobile client\n participant IDO as IDO SDK\n participant IDV as IDV SDK\n participant M as Mosaic\n\n User-->>Mobile: Scans QR code\n Mobile->>Mobile: Init SDKs\n Mobile->>IDO: Start journey (with ticket)\n IDO-->>IDO: Match case: detect mobile + cross-session\n IDO->>Mobile: Selfie acquisition step\n IDV->>User:Capture selfie\n User->>IDV: Selfie\n IDV-->>IDO: Complete\n IDO-->>M: Selfie data\n M-->>M: Face authentication\n M-->>IDO: Complete\n IDO-->>M: Process cross-session message\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"before-you-start","__idx":4},"children":["Before you start"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete all prerequisite steps described in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face#before-you-start"},"children":["Face authentication"]}," guide, including creating an application, installing SDKs, and implementing a login method for existing users."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support-cross-device-handoff-in-the-journey","__idx":5},"children":["Support cross-device handoff in the journey"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge-wrapper"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"className":"badge"},"children":["Admin Portal"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The cross-device flow requires modifying the authentication journey from the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face#authentication-journey"},"children":["base guide"]}," to detect the client platform and route the flow accordingly."]},{"$$mdtype":"Tag","name":"figure","attributes":{"style":{"margin":"0"}},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/assets/auth_face_cross_device.39527f060a95e4c5c3196d29d5b2846928dd95a89ae7486149bd3e4e955b4d39.2397ab79.png","target":"_blank"},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/auth_face_cross_device.39527f060a95e4c5c3196d29d5b2846928dd95a89ae7486149bd3e4e955b4d39.2397ab79.png","alt":"Face authentication in cross-device flow","style":{"maxWidth":"100%"}},"children":[]}]},{"$$mdtype":"Tag","name":"figcaption","attributes":{"style":{"color":"grey","fontStyle":"italic","fontSize":"14px"}},"children":["\n Click to open the image in a dedicated tab.\n "]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Example"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is an example journey that represents a basic use case that uses face authentication as a second factor after email OTP. Adjust your journey as needed. The numbered callouts in the example journey above highlight the areas that differ from the basic use case and require configuration for cross-device face authentication."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"1-match-case-branching","__idx":6},"children":["1. Match case branching"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/match_case"},"children":["Match case"]}," step as an initial step in the journey. The source expression should detect whether the journey is running on a mobile or desktop device and whether a cross-session message is present before branching accordingly. For example, you can use the code below to evaluate the user agent and check for a cross-session message."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"let userAgent = @policy.request().headers[\"user-agent\"] return\nlet commonMobileKeys = [\"Mobi\",\"Android\",\"iPhone\",\"iPad\",\"iPod\",\"Windows Phone\",\"Opera Mini\",\"IEMobile\"] return\nlet isMobile = @std.containsIf(commonMobileKeys, (item) => @strings.refind(userAgent,item)) return\nlet isCross = @policy.getInteractionParameters().interactionParams.claims.csm != null return\nlet result = isMobile ? (isCross ? \"Mobile - Cross\" : \"Mobile - Main\") : (isCross ? \"Desktop - Cross\" : \"Desktop - Main\")\nreturn result\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This routes the journey into one of the following branches:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Branch"},"children":["Branch"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Desktop - Main"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The journey runs on a desktop without a cross-session context. This is the primary entry point: collects the user identifier and initiates the cross-device handoff."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mobile - Main"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The journey runs on a mobile device without a cross-session context. This is the primary entry point for the standard mobile face authentication (same as the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/user/auth_face"},"children":["base guide"]},")."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mobile - Cross"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The journey runs on a mobile device with a cross-session context. This is the branch triggered when the user scans the QR code—it performs the selfie capture and communicates the result back."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Desktop - Cross"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not a valid scenario. Routes to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/reject_access"},"children":["Reject access"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Otherwise"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Fallback for unrecognized contexts. Routes to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/reject_access"},"children":["Reject access"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"2-desktop---main-branch","__idx":7},"children":["2. Desktop - Main branch"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This branch represents the primary entry point for the cross-device use case. The user starts the face authentication on the desktop, and the journey initiates the cross-device handoff to a mobile device. For example, it can include the following actions:"]},{"$$mdtype":"Tag","name":"figure","attributes":{"style":{"margin":"0"}},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/assets/auth_face_cross_device_desktop.d3905b7c821c70b7f360554228e1952ce13e10014e46068b4daef41b693ba3c8.2397ab79.png","target":"_blank"},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/auth_face_cross_device_desktop.d3905b7c821c70b7f360554228e1952ce13e10014e46068b4daef41b693ba3c8.2397ab79.png","alt":"Face authentication in cross-device flow: desktop main branch","style":{"maxWidth":"100%"}},"children":[]}]},{"$$mdtype":"Tag","name":"figcaption","attributes":{"style":{"color":"grey","fontStyle":"italic","fontSize":"14px"}},"children":["\n Click to open the image in a dedicated tab.\n "]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/login_form"},"children":["Login form"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/authenticate_email_otp"},"children":["Email OTP authentication"]}," steps: Displays the login form and performs email OTP authentication as a first factor."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/create_cross-session_message"},"children":["Create cross-session message"]}," step: Creates a cross-session message containing the user context so it can be shared with the mobile session. Configure the step as follows:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cross-session message request fields"]},": add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_context"]}," field with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@policy.userContext()"]}," value"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Output variable"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["csm"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/wait_for_cross-session_message"},"children":["Wait for cross-session message"]}," step: Waits for the mobile device to process the cross-session message, displaying a QR code that the user scans with their phone. Configure the step as follows:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["csm"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id format"]},": set to \"Display as QR code\""]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id display mode"]},": set to \"Display Custom Expression\""]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id to display"]},": set to expression below. Client ID can be found in your app settings in the Admin Portal. Redirect URL can be any page the client redirects to upon completion, such as SSO hosted domain URL or your custom domain. Base URL depends on your region or custom domain (api.transmitsecurity.io, api.sbx.transmitsecurity.io, etc.),"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":" let clientId = \"\" return\n let redirectUrl = `https:///cross-device-complete/?clientId=${clientId}` return\n let claims = @strings.tojson({csm: csm, id_token:{}}) return\n `https:///cis/oidc/auth?client_id=${clientId}&redirect_uri=${@strings.urlEncode(redirectUrl)}&response_type=code&prompt=login&scope=openid&claims=${@strings.urlEncode(claims)}`\n","lang":"bash"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/condition"},"children":["Condition"]}," step: Once the mobile session completes, checks whether the face authentication succeeded."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/complete_journey"},"children":["Complete journey"]}," or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/reject_access"},"children":["Reject access"]}," steps: Depending on the result, successfully completes the journey or rejects access."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3-mobile---cross-branch","__idx":8},"children":["3. Mobile - Cross branch"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This branch runs on the mobile device after the user scans the QR code displayed on the desktop. It performs the selfie capture and face authentication, then communicates the result back to the desktop session. For example, it can include the following actions:"]},{"$$mdtype":"Tag","name":"figure","attributes":{"style":{"margin":"0"}},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/assets/auth_face_cross_device_mobile.c5d6a8da5b398e5c74bdaf79f24ea0f0afb7893361196e04b7aa92183624069d.2397ab79.png","target":"_blank"},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/auth_face_cross_device_mobile.c5d6a8da5b398e5c74bdaf79f24ea0f0afb7893361196e04b7aa92183624069d.2397ab79.png","alt":"Face authentication in cross-device flow: mobile cross branch","style":{"maxWidth":"100%"}},"children":[]}]},{"$$mdtype":"Tag","name":"figcaption","attributes":{"style":{"color":"grey","fontStyle":"italic","fontSize":"14px"}},"children":["\n Click to open the image in a dedicated tab.\n "]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/set_temporary_variables"},"children":["Set temporary variables"]}," step: Extracts cross-session message values and sets temporary variables for use later in the flow. Configure this step as follows:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Variable ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["csm"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@policy.getInteractionParameters().interactionParams.claims.csm"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Variable ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["original_user_context"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@policy.readCrossSessionMessage(@policy.getInteractionParameters().interactionParams.claims.csm).user_params.user_context"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/restore_user_context"},"children":["Restore user context"]}," step: Restores the user context from the cross-session message so the journey can act on behalf of the authenticated user. Configure this step as follows:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Saved user context"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["original_user_context"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If you expect multiple users to use the same device for authentication (meaning somebody could have already authenticated on this mobile device), consider clearing user context first by setting ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Saved user context"]}," to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/selfie_acquisition"},"children":["Selfie acquisition"]}," step: Obtains a selfie image from the user on the mobile device."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/authenticate_face"},"children":["Face authentication"]}," step: Verifies the selfie (obtained from the journey context) against the stored reference vector. Configure this step as follows:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifiers"]},": set to \"Email\""]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Identifier value"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@policy.userContext().user_identifiers.email"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Depending on the result:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Success"]},": ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/process_cross-session_message"},"children":["Process cross-session message"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/complete_journey"},"children":["Complete journey"]}," steps: Processes the cross-session message to signal success back to the desktop session, then completes the journey. Configure the Process cross-session message step as follows:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cross-session message reply fields"]},": add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," field with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["@policy.userContext().access_token"]}," value"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Output variable"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cross_session_message"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["csm"]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Failure"]},": ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/process_cross-session_message"},"children":["Process cross-session message"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/orchestration/journeys/reject_access"},"children":["Reject access"]}," steps: Processes the cross-session message to signal failure back to the desktop session, then rejects access. Configure the Process cross-session message step as follows:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cross-session message reply fields"]},": add ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]}," field with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]}," value"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Output variable"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cross_session_message"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Message id"]},": set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["csm"]}]}]}]}]}]}]}]},"headings":[{"value":"Cross-device face authentication","id":"cross-device-face-authentication","depth":1},{"value":"How it works","id":"how-it-works","depth":2},{"value":"Face registration","id":"face-registration","depth":3},{"value":"Cross-device face authentication","id":"cross-device-face-authentication-1","depth":3},{"value":"Before you start","id":"before-you-start","depth":2},{"value":"Support cross-device handoff in the journey","id":"support-cross-device-handoff-in-the-journey","depth":2},{"value":"1. Match case branching","id":"1-match-case-branching","depth":3},{"value":"2. Desktop - Main branch","id":"2-desktop---main-branch","depth":3},{"value":"3. Mobile - Cross branch","id":"3-mobile---cross-branch","depth":3}],"frontmatter":{"markdown":{"toc":{"depth":3}},"seo":{"title":"Cross-device face authentication"}},"lastModified":"2026-07-13T08:28:21.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/user/auth_face_cross_device","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}