--- title: "FIDO-Based Authentication" slug: "oca-ig-fido-based-authentication" updated: 2025-12-10T11:37:46Z published: 2025-12-10T11:37:46Z canonical: "docs.onespan.com/oca-ig-fido-based-authentication" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # FIDO-Based Authentication OneSpan Cloud Authentication allows you to integrate FIDO-based authentication in your solution. It supports the following FIDO protocols: - FIDO UAF (Universal Authentication Framework) - FIDO2 ## FIDO UAF OneSpan Cloud Authentication (OCA) provides the functionality of a FIDO UAF Server as a service. It is exposed via a set of APIs that enables the relying parties to provide secure passwordless registration, authentication, and transaction signing capabilities. ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/fido_uaf_onboarding_infra.png?sv=2026-02-06&spr=https&st=2026-11-14T07%3A30%3A13Z&se=2026-11-14T08%3A30%3A13Z&sr=c&sp=r&sig=%2F9qIBzuLfxHmN%2B%2FvxNS6O13IX60PiQAfVbWu99Rrx1Q%3D) FIDO UAF infrastructure — overview OneSpan Cloud Authentication handles the following processes for the server-side implementation of the FIDO UAF protocol: - Communication of the FIDO UAF protocol messages to a FIDO user device (usually a mobile app). - Validation of the FIDO UAF authenticator attestations to ensure only trusted authenticators are registered for use (see [FIDO Metadata Service](/sec/docs/oca-ig-fido-based-authentication#fido-metadata-service)). - Validation of the FIDO UAF authenticator attestations to ensure the characteristics of the authenticators are within the boundaries of the defined [FIDO UAF policy](/sec/docs/oca-ig-fido-based-authentication#fido-uaf-policy). - Outline the scope of the generated credentials via the [AppID](/sec/docs/oca-ig-fido-based-authentication#app-id) URL. - Link the registered FIDO UAF authenticator to a TID user account. - Evaluation of the user authentication and transaction confirmation responses to determine their validity. ### APP ID During the FIDO UAF registration, a private/public key pair is generated on the authenticator side. The public key is passed from the client and stored on the FIDO UAF Server. As part of this process, each key is associated with an AppID. On the client side, a FIDO Client dereferences the AppID URL and process it by extracting the list of trusted facets, such as the mobile apps that are allowed to use the newly generated keys. ### FIDO UAF policy The UAF policies define the characteristics of authenticators used for UAF operations (registration and authentication). These policies are defined per relying party, and contain the following two fields: - accepted, type sequencesequence The accepted field is a list of sets of match criteria. > A valid policy must have at least one set of authenticators on the list of accepted match criteria. - disallowed, type sequenceMatchCriteria The disallowed field describes authenticators which are excluded from the operation, even if it overlaps with any authenticator on the accepted list (i.e. mandatory fields for both elements are equal). ## FIDO2 OneSpan Cloud Authentication provides the functionality of a FIDO2 Server as a service. It is exposed via a set of APIs that allow the relying parties to provide secure passwordless registration and authentication capabilites. This is accomplished either through the use of authenticators that implement the Client-to-Authenticator Protocol (CTAP) and platforms, or browsers that implement the W3C WebAuthn specification. ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/fido2_onboarding_production_infra.png?sv=2026-02-06&spr=https&st=2026-11-14T07%3A30%3A13Z&se=2026-11-14T08%3A30%3A13Z&sr=c&sp=r&sig=%2F9qIBzuLfxHmN%2B%2FvxNS6O13IX60PiQAfVbWu99Rrx1Q%3D) FIDO2 infrastructure — overview OneSpan Cloud Authentication (OCA) handles the following processes for the server-side implementation of the W3c WebAuthn Specification: - Validation of the FIDO2 authenticator attestations to ensure only trusted authenticators are registered for use (see [FIDO Metadata Service](/sec/docs/oca-ig-fido-based-authentication#fido-metadata-service)). - Outline the scope of the generated credentials. - Link the registered FIDO2 authenticator to a user account. - Evaluation of the user authentication responses (assertions) to determine their validity. With FIDO2 it is also possible to log in to a system without a user name by means of Discoverable Credentials. With these, the client system detects available FIDO2 passkeys, extracts the user name out of these credentials, and prompts the user to log in. Discoverable credentials make the login process more seamless as the user does not have to type in their user name. This feature is available with OneSpan Cloud Authentication, for more information, see [FIDO-based user login without user name: discoverable credentials](/sec/docs/oca-ig-integration-of-user-login-with-fido-based-authentication#fidobased-user-login-without-user-name-discoverable-credentials). ## FIDO Metadata Service OneSpan Cloud Authentication validates the FIDO authenticator attestation against the FIDO Metadata Service, which provides a trusted source of information about the FIDO authenticator. OneSpan Cloud Authentication manages the metadata that it receives from the FIDO Alliance Metadata Service in its own metadata service. This is kept up-to-date to ensure it has the latest information about the new authenticators. For more information about FIDO Alliance Metadata Service, refer to the [FIDO Alliance documentation](https://fidoalliance.org/metadata/). ## Next steps For more information about how to configure the FIDO feature in OneSpan Cloud Authentication, refer to the following articles: - For the FIDO UAF protocol, see [FIDO UAF onboarding in the Sandbox and Production environments](/sec/docs/oca-ig-fido-uaf-onboarding-in-the-sandbox-and-production-environments). - For the FIDO2 protocol, see [FIDO2 in the Sandbox environment](/sec/docs/oca-ig-fido2-in-the-sandbox-environment) and [FIDO2 in the Production environment](/sec/docs/oca-ig-fido2-in-the-production-environment). For information about the integration of FIDO-based authentication, see [Integration of user login with FIDO-based authentication](/sec/docs/oca-ig-integration-of-user-login-with-fido-based-authentication).