Introduction
The Cordova App SDK enables you to write apps using strong authentication. These apps can run on Android and iOS devices as well as web browsers. The API interface is identical to that of the Web App SDK. On mobile, the API accesses the native FIDO functionality. For a web app, the API accesses the Web Authentication capabilities of the browser. Comparing Functionality on Different Platforms summarises the differences between the Web App SDK and Cordova App SDK.
By using this Guide, you learn how to:
Integrate a mobile app with the Digipass S3 Authentication Software
Deliver strong authentication on FIDO Ready™ and FIDO Certified™ devices
Support non-FIDO Ready and non-FIDO Certified devices
The Cordova App SDK consists of the following plugins:
plugin_appsdk provides strong authentication using the Digipass S3 App SDK and FIDO. This plugin contains all of the code to use the Digipass S3 Web client API.
plugin_appsdk_oob (optional) provides out-of-band (OOB) authentication as a second device using native layer functionality. This plugin requires the plugin_appsdk and the plugin_appsdk_plus to work.
plugin_appsdk_plus (optional) contains deprecated APIs that should not be called directly from the app, but this plugin is required by the plugin_appsdk_oob.
plugin_appsdk_hms (optional) provides components required to receive and handle push notifications on Android Huawei devices. This plugin requires plugin_appsdk_oob.
The Cordova App SDK is used with the following Digipass S3 App SDK versions. These are automatically included when you install the Cordova App SDK.
Android App SDK 9.4.0
iOS App SDK 9.4.0
For additional platform dependencies, see https://cordova.apache.org/#getstarted
Overview
The major topics covered here fall into the following areas:
Setting up the App SDK - Includes the script tags that load the Cordova App SDK.
Build and Deploy Tutorial App - Covers how to install the Cordova App SDK using the platform-specific build scripts that also build Tutorial App.
Removing a Plugin - Contains instructions to remove a Cordova plugin.
Implementing Authentication in Your App - For the most part, you can use the Web App Developer Guide to learn how to implement authentication in your app. Cordova differs from the Web App SDK in how you configure the App SDK to send signals used by Adaptive Rules and use out-of-band authentication as a second device.
Customizing and Packaging the Cordova App SDK - Provides instructions on how to add your app to the Authentication Server and modify the appearance. Android apps built with the Cordova App SDK should exclude database files from Android's auto backup.
Comparing functionality on different platforms
The Cordova SDK has slightly different behaviour from the Web App SDK on the Web.
Cordova | Web | |
|---|---|---|
Registration, Authentication, Transaction Confirmation, and Managing Registrations | ![]() Accepted | ![]() Accepted |
UAF Protocol | ![]() Accepted | ![]() Rejected |
FIDO2 Protocol | ![]() Accepted | ![]() Accepted |
OOB as 1st device (display QR code, send push) | ![]() Accepted | ![]() Accepted |
OOB as 2nd device (scan QR code, receive push) | ![]() Accepted | ![]() Accepted |
Managing Personally Identifiable Information | ![]() Accepted | ![]() Accepted |
App-less QR OOB Support | ![]() Accepted | ![]() Accepted |
Secure Payment Confirmation (SPC) | ![]() Rejected | ![]() Accepted |
Use of App SDK iframe | ![]() Rejected | ![]() Accepted |
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)
.png?sv=2026-02-06&spr=https&st=2026-09-30T03%3A51%3A50Z&se=2026-09-30T04%3A03%3A50Z&sr=c&sp=r&sig=sWNhHW3OkJ%2BkBp3a6LW8T%2BXO%2BqvB7xQQmAqXD2APGu0%3D)