---
title: "Create an External Authentication Plugin"
slug: "s3suite94-create-an-external-authentication-plugin"
updated: 2026-10-27T18:42:23Z
published: 2026-10-27T18:42:23Z
canonical: "docs.onespan.com/s3suite94-create-an-external-authentication-plugin"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an External Authentication Plugin

## Introduction

When an end user needs to verify their identity with an External Authentication Method, one of your company servers, not the Nok Nok Authentication Server, authenticates the end user. This section refers to this company server as the RP Server.

When the App SDK receives a request for authentication using an External Authentication Method, your app sends the user verification data to your RP server. On successful user verification, your RP Server must return a credential. The Nok Nok JWT External Authentication plugin can validate this credential only if it is a JWT with standard [claims](/dpoa/docs/s3suite94-claim-set). If your RP Server cannot return such a JWT, then Nok Nok's [JWT External Authentication](/dpoa/docs/s3suite94-configure-a-jwt-external-authentication-method) plugin won't work for you. If the user verification data is username and password, then you can use a [Password External Authentication](/dpoa/docs/s3suite94-configure-a-password-external-authentication-method) method. Otherwise, you must create a custom External Authentication plugin to validate the credential that your RP Server returns. The rest of this section describes how to create a custom External Authentication plugin.

![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/image1(2).png?sv=2026-02-06&spr=https&st=2026-10-29T03%3A25%3A09Z&se=2026-10-29T04%3A25%3A09Z&sr=c&sp=r&sig=ztmnFSrCgIGKfsV0zHsSfuzrxINPDk5%2B7lf9%2FYsoURg%3D)

**Figure 10** External Authentication

Your custom External Authentication plugin is a class that implements Nok Nok's ISessionManager interface. Your ISessionManager class only needs to implement the onVerifyRequest() method. Your ISessionManager class can optionally implement the onResponse() method. Any other methods are ignored. The API Server calls your onVerifyRequest() method when it receives either a VERIFY or an INIT_ADAPTIVE request, then it calls your onResponse() method when the processing of the request is complete.

For information about building and deploying custom API Server plugins, see [Create a plugin](/dpoa/docs/s3suite94-create-a-custom-api-server-plugin).

See *Using an External Authentication Method* in the *Developer Guide* for [Android](/sec/docs/s3suite94-android-developer-guide-for-android), [iOS](/sec/docs/s3suite94-ios-developer-guide-for-ios) or [Web](/sec/docs/s3suite94-web-developer-guide-for-web).