Functions

All methods are exposed on the cordova.tsauth object, which is available after the deviceready event. Every method except isUserCanceled returns a Promise.

Rejections always use { code, platformCode, message }. Branch on code (ERRORS). Log platformCode, which is the native SDK's own name. When a platform error has no mapping, code is the raw platformCode rather than internalError.

▸ initializeSDK(configurationFile?): Promise<boolean>

Initializes the plugin from TransmitSecurity.plist on iOS or from strings.xml on Android. configurationFile is the iOS plist basename and defaults to TransmitSecurity. Android ignores it.

Promise<boolean>

Resolves with true.

await cordova.tsauth.initializeSDK();

▸ initialize(clientId, options?): Promise<boolean>

Initializes the plugin with an explicit client ID. Use this when credentials are not read from the native config file.

Promise<boolean>

Resolves with true.

await cordova.tsauth.initialize('YOUR_CLIENT_ID', {
  baseUrl: 'https://api.transmitsecurity.io/',
  domain: 'your-domain.com',
});

▸ setLoggingEnabled(enabled): Promise<boolean>

Turns native and JavaScript logging on or off. Logging is off by default.

Promise<boolean>

Resolves with true.

await cordova.tsauth.setLoggingEnabled(true);

▸ isWebAuthnSupported(): Promise<boolean>

Reports whether this device and OS can use passkeys. Check this before offering passkey registration or authentication.

Promise<boolean>

if (await cordova.tsauth.isWebAuthnSupported()) {
  await cordova.tsauth.registerWebAuthn('alice@example.com', 'Alice');
}

▸ registerWebAuthn(username, displayName?): Promise<{ result: string }>

Registers a passkey for username. POST result to your backend, or pass it to an Orchestration journey with submitClientResponse.

Promise<{ result: string }>

result is the encoded credential.

const { result } = await cordova.tsauth.registerWebAuthn('alice@example.com', 'Alice');

▸ registerWebAuthnWithData(registrationData): Promise<{ result: string }>

Registers a passkey from a server-provided WebAuthn registration payload, for flows where your backend already called start-registration.

Promise<{ result: string }>

const { result } = await cordova.tsauth.registerWebAuthnWithData(registrationData);

▸ authenticateWebAuthn(username, options?): Promise<{ result: string }>

Authenticates with a passkey. Pass username as '' to let the platform offer any local passkey.

Promise<{ result: string }>

const { result } = await cordova.tsauth.authenticateWebAuthn('alice@example.com');

▸ authenticateWebAuthnWithData(authenticationData, options?): Promise<{ result: string }>

Authenticates from a server-provided WebAuthn authentication payload.

Promise<{ result: string }>

const { result } = await cordova.tsauth.authenticateWebAuthnWithData(authenticationData);

▸ signWebAuthnTransaction(username, options?): Promise<{ result: string }>

Signs a transaction with a passkey.

Promise<{ result: string }>

const { result } = await cordova.tsauth.signWebAuthnTransaction('alice@example.com');

▸ signWebAuthnTransactionWithData(authenticationData, options?): Promise<{ result: string }>

Signs a transaction from a server-provided WebAuthn authentication payload.

Promise<{ result: string }>

const { result } = await cordova.tsauth.signWebAuthnTransactionWithData(authenticationData);

▸ approvalWebAuthn(approvalData, username?, options?): Promise<{ result: string }>

Runs a cross-device approval with a passkey.

Promise<{ result: string }>

const { result } = await cordova.tsauth.approvalWebAuthn(approvalData, 'alice@example.com');

▸ approvalWebAuthnWithData(authenticationData, options?): Promise<{ result: string }>

Runs a cross-device approval from a server-provided WebAuthn authentication payload.

Promise<{ result: string }>

const { result } = await cordova.tsauth.approvalWebAuthnWithData(authenticationData);

▸ registerNativeBiometrics(username): Promise<Object>

Enrolls the device biometric key for username.

Promise<{ publicKeyId: string, publicKey: string, keyType: string, attestation: string, os: string }>

const registration = await cordova.tsauth.registerNativeBiometrics('alice@example.com');

▸ authenticateNativeBiometrics(username, challenge, promptTexts?): Promise<Object>

Signs challenge with the device biometric key and prompts the user. promptTexts applies on Android. iOS uses the system Face ID or Touch ID prompt and ignores promptTexts. The plugin supplies default prompt text.

Promise<{ publicKeyId: string, signature: string }>

const signed = await cordova.tsauth.authenticateNativeBiometrics(
  'alice@example.com',
  challenge
);

▸ approvalNativeBiometrics(username, challenge, promptTexts?): Promise<Object>

Signs challenge for an out-of-band approval. Same parameters and return value as authenticateNativeBiometrics.

const signed = await cordova.tsauth.approvalNativeBiometrics('alice@example.com', challenge);

▸ unregisterNativeBiometrics(username): Promise<{ publicKeyId: string }>

Removes the device biometric key for username.

Promise<{ publicKeyId: string }>

const removed = await cordova.tsauth.unregisterNativeBiometrics('alice@example.com');

▸ getNativeBiometricsStatus(): Promise<Object>

Reports whether biometrics can be used on this device right now.

Promise<{ status: string, statusRaw: string, enrolled: boolean, type: string }>

status is one of BIOMETRICS_STATUS. type is faceID, touchID, or opticID on iOS, and biometric on Android. The plugin can also return none.

const bio = await cordova.tsauth.getNativeBiometricsStatus();
if (bio.status !== cordova.tsauth.BIOMETRICS_STATUS.AVAILABLE) {
  // Offer PIN or a passkey instead
}

▸ registerPinCode(username, pinCode): Promise<Object>

Starts PIN registration. The registration is held in memory and becomes durable only after commitPinRegistration. Commit after your backend has accepted the public key.

If the app restarts before commit, the context identifier is gone and commitPinRegistration rejects with invalidArgs. Start registration again.

Promise<{ publicKeyId: string, publicKey: string, keyType: string, aliasDeviceName: string, contextIdentifier: string }>

const reg = await cordova.tsauth.registerPinCode('alice', '1234');
await myBackend.storePublicKey(reg.publicKey, reg.publicKeyId);
await cordova.tsauth.commitPinRegistration(reg.contextIdentifier);

▸ commitPinRegistration(contextIdentifier): Promise<boolean>

Finalizes a registerPinCode call after the backend has accepted the public key.

Promise<boolean>

Resolves with true.

await cordova.tsauth.commitPinRegistration(reg.contextIdentifier);

▸ authenticatePinCode(username, pinCode, challenge): Promise<Object>

Signs challenge with the registered PIN.

Promise<{ publicKeyId: string, signature: string, challenge: string }>

const signed = await cordova.tsauth.authenticatePinCode('alice', '1234', challenge);

▸ unregisterPinCode(username): Promise<Object>

Starts PIN removal. Call commitPinUnregistration with the returned contextIdentifier to make the removal durable. The same in-memory rule as registration applies.

Promise<{ publicKeyId: string, contextIdentifier: string }>

const pending = await cordova.tsauth.unregisterPinCode('alice');
await cordova.tsauth.commitPinUnregistration(pending.contextIdentifier);

▸ commitPinUnregistration(contextIdentifier): Promise<boolean>

Finalizes unregisterPinCode.

Promise<boolean>

Resolves with true.

await cordova.tsauth.commitPinUnregistration(pending.contextIdentifier);

▸ registerTOTP(uri, securityType?): Promise<Object>

Registers a TOTP authenticator from an otpauth:// URI. Persist uuid. Later code generation uses that id. Any securityType other than none prompts the user when a code is generated.

Promise<{ issuer: string, label: string, uuid: string }>

const totp = await cordova.tsauth.registerTOTP(
  uri,
  cordova.tsauth.TOTP_SECURITY_TYPE.BIOMETRIC
);

▸ generateTOTPCode(uuid): Promise<{ code: string }>

Generates a TOTP code for a registered authenticator.

Promise<{ code: string }>

const { code } = await cordova.tsauth.generateTOTPCode(uuid);

▸ generateTOTPCodeWithChallenge(uuid, challenge): Promise<{ code: string }>

Generates a TOTP code bound to challenge, for transaction signing.

Promise<{ code: string }>

const { code } = await cordova.tsauth.generateTOTPCodeWithChallenge(uuid, challenge);

▸ getDeviceInfo(): Promise<Object>

Returns the device public key.

Promise<{ publicKeyId: string, publicKey: string, keyType: string }>

keyType is present on Android.

const device = await cordova.tsauth.getDeviceInfo();

▸ signWithDeviceKey(challenge): Promise<{ signature: string }>

Signs an arbitrary challenge with the device key.

Promise<{ signature: string }>

const { signature } = await cordova.tsauth.signWithDeviceKey(challenge);

▸ isUserCanceled(error): boolean

Returns true when a rejection is the user leaving a prompt. This method is synchronous.

boolean

try {
  await cordova.tsauth.registerWebAuthn('alice@example.com');
} catch (e) {
  if (cordova.tsauth.isUserCanceled(e)) return;
  console.warn(e.code, e.platformCode, e.message);
}