--- title: "FIDO2 in the Sandbox environment" slug: "oca-ig-fido2-in-the-sandbox-environment" updated: 2026-02-25T10:57:13Z published: 2026-02-25T10:57:13Z canonical: "docs.onespan.com/oca-ig-fido2-in-the-sandbox-environment" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # FIDO2 in the Sandbox environment FIDO2 is a standard for strong authentication in the web. It is comprised of the WebAuthn specification and the corresponding Client-to-Authenticator Protocol (CTAP). It allows users to authenticate to online services with their devices and/or authenticators without the need to enter a password. It can be accomplished both on their desktop and mobile environments. For more information on WebAuthn and CTAP, refer to the [FIDO Alliance documentation](https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/). In the Sandbox environment you can simulate and test the capabilities of the FIDO2 ceremonies with the help of the FIDO2 Bank Demo Web App and FIDO2 Sample Relying Party Web App. ![](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/fido2_onboarding_sandbox_infra.png?sv=2026-02-06&spr=https&st=2026-11-14T07%3A06%3A14Z&se=2026-11-14T08%3A06%3A14Z&sr=c&sp=r&sig=27FCkZWcfFkumdN3bAAGsuRRM0uD%2FnId4HFzeTPQykg%3D) Overview of the Sandbox environment OneSpan prepares a FIDO2 deployment specifically for your tenant in the Sandbox environment. The deployment involves the following parties: - Client infrastructure. This includes the platform and cross-platform authenticators, as well as the web browser (with WebAuthN support). By default, OneSpan supports the FIDO2 authenticators which are part of the FIDO Alliance Metadata Service version 3.0. - Relying Party Service. The web server application which provides the registration and authentication features. Its back end communicates via a secure connection (TLS certificates) with the OneSpan Trusted Identity platform API. In the Sandbox environment, you can use the FIDO2 Bank Demo Web App and FIDO2 Sample Relying Party Web App to demonstrate the capabilities of the FIDO2 registration and authentication ceremonies. On the client side, the FIDO2 Bank Demo Web App and FIDO2 Sample Relying Party Web App demonstrate the interaction between the web browser and the available FIDO2 authenticators. On the back-end side, the FIDO2 Bank Demo Web App and FIDO2 Sample Relying Party Web App forward the data structures, which were processed by the authenticator, to the OneSpan Trusted Identity platform. These data structures are then further processed and validated by the FIDO2 Server. Once FIDO2 has been enabled, you will be able to access: > Use the FIDO2 Bank Demo Web App to demonstrate the basic FIDO2 capabilities. For more information about the FIDO2 Bank Demo Web App, see [FIDO2 Bank Demo Web App](/sec/docs/oca-ig-fido2-bank-demo-web-app). > > Use the FIDO2 Sample Relying Party Web App to extensively test and simulate the FIDO2 capabilities. The FIDO2 Sample Relying Party Web App will assist you to integrate your relying party solution. For more information about the FIDO2 Sample Relying Party Web App, see [FIDO2 Sample Relying Party Web App](/sec/docs/oca-ig-fido2-sample-relying-party-web-app). - The FIDO2 Bank Demo Web App via https://yourtenant.sdb.tid.onespan.cloud/v1/mybank-fido - The FIDO2 Sample Relying Party Web App via https://yourtenant.sdb.tid.onespan.cloud/v1/fido-sample-relying-party - OneSpan Trusted Identity platform API. This REST API exposes the FIDO2 Server functionality via dedicated FIDO endpoints that are available in OneSpan Cloud Authentication. For more information about FIDO concepts, refer to the [specifications](https://fidoalliance.org/specifications/) and [technical glossary](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/fido-glossary-v1.1-ps-20170202(1).html?sv=2026-02-06&spr=https&st=2026-11-14T07%3A06%3A14Z&se=2026-11-14T08%3A06%3A14Z&sr=c&sp=r&sig=27FCkZWcfFkumdN3bAAGsuRRM0uD%2FnId4HFzeTPQykg%3D) provided by the FIDO Alliance. ## Configure FIDO2 in the Sandbox environment For the FIDO2 configuration and onboarding process, you can choose to enable FIDO2 either via Self-Service Onboarding feature or with the help of our support staff. ### Self-serviced onboarding The FIDO2 Self-Service Onboarding feature allows you to configure FIDO2 using the OneSpan Trusted Identity platform REST API endpoints, as well as enabling the FIDO2-based functionalities with OneSpan Cloud Authentication for the Production environment. To enable FIDO2 in OneSpan Cloud Authentication you need to create a Relying Party Resource. To create a Relying Party Resource - Call the [POST /fido2-relying-parties](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2%20Relying%20Parties/createRelyingPartyUsingPOST) endpoint in the OneSpan Trusted Identity platform REST API. Ensure that the request body contains the mandatory field publicKeyCredentialRpEntity of the type object, with the mandatory fields In addition, the request body needs to contain the mandatory field origins of the type array with at least one entry. - id (Relying Party ID) - name, and - icon Your web application is now ready to use the supported FIDO2-based operations with OneSpan Cloud Authentication. ### Onboard FIDO2 with OneSpan Support To enable the integration of FIDO2-based functionalities with OneSpan Cloud Authentication for the Production environment, the following information must be provided to properly configure FIDO2: To enable the integration of FIDO2-based functionalities with OneSpan Cloud Authentication for the Sandbox environment, the following information must be provided to properly configure FIDO2: - Tenant name - (If required) Metadata statements > To enable FIDO2 for the Sandbox environment, submit a service request on the [Product Support](https://support.onespan.com/) page by clicking the corresponding button. ### Tenant name Ensure that you already have created a tenant. To enable FIDO2, provide the tenant name to OneSpan support—our support staff will activate FIDO2 for you. ### Metadata statements The FIDO2 Server works out-of-the-box with a list of supported FIDO2 authenticators which are part of the FIDO Alliance Metadata Service version 3.0. > If you intend to use authenticators that are not included in the FIDO Alliance Metadata Service, ensure that you provide the relevant metadata statements to OneSpan in the v3 format. For more information about FIDO2 authenticators supported by the FIDO Alliance Metadata Service, see [FIDO2-supported authenticators](/sec/docs/oca-ig-standard-fido-settings-for-the-sandbox-environment). ### Managing FIDO2 Relying Party Resources You can manage Relying Party Resources by using the following OneSpan Trusted Identity platform REST API endpoints.

Create a new FIDO2 Relying Party Resource

 Query FIDO2 Relying Party Resources To query the FIDO2 Relying Party Resource, call the following endpoint: [GET ​/fido2-relying-parties](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/retrieveRelyingPartiesUsingGET) The responses for this endpoint include the following: - 200: FIDO2 Relying Parties retrieved successfully. - 400: Input data errors. - 500: Internal error, sub-service failure, server crash. Retrieve a specific FIDO2 Relying Party Resource by ID To retrieve a specific FIDO2 Relying Party Resource ID, call the following endpoint: [GET ​/fido2-relying-parties/{uuid}](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/retrieveRelyingPartyByIdUsingGET) The responses for this endpoint include the following: - 200: FIDO2 Relying Parties retrieved successfully. - 400: Input data errors. - 404: FIDO2 Relying Party not found. - 500: Internal error, sub-service failure, server crash.

Set a FIDO2 Relying Party Resource as default

 You can have more than one Relying Party Resource. Only the one that is set as the default is relevant for the registration and authentication operations. To set a FIDO2 Relying Party Resource as default, call the following endpoint: [POST ​/fido2-relying-parties/{uuid}/make-default](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/setDefaultRelyingPartyPost) The responses for this endpoint include the following: - 204: Make default operation successful. - 400: Input data errors. - 404: FIDO2 Relying Party not found. - 500: Internal error, sub-service failure, server crash. > Only one Relying Party Resource can be the default at any given time. If you make another Relying Party the default, the Relying Party that is currently the default will automatically lose its default status. > If you change the default FIDO2 Relying Party Resource, registrations that were performed in the context of that previous default Relying Party Resource will not be working, unless you use the same Relying Party ID (publicKeyCredentialRpEntity.id) and origins. Update a FIDO2 Relying Party Resource To update an existing FIDO2 Relying Party Resource, call the following endpoint: [PATCH ​/fido2-relying-parties​/{uuid}](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/updateRelyingPartyByIdUsingPATCH) The responses for this endpoint include the following: - 200: FIDO2 Relying Party update successful. - 400: Input data errors. - 404: FIDO2 Relying Party not found. - 500: Internal error, sub-service failure, server crash. > When updating a Relying Party Resource, only the fields that require an update need to be provided in the request body. Fields that are not provided will remain unchanged. > If you change the Relying Party ID (publicKeyCredentialRpEntity.id) or origins when updating your Relying Party Resource, note that registrations that were previously performed will not work anymore. To restore these registrations, you need to call the [PATCH ​/fido2-relying-parties​/{uuid}](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/updateRelyingPartyByIdUsingPATCH) endpoint and enter the correct Relying Party ID (publicKeyCredentialRpEntity.id) and origins values. > > We recommend as a best practice to keep records of the old Relying Party ID and origins values, as it will allow you to restore your Relying Party Resource registrations in case of problems. Delete a FIDO2 Relying Party Resource To delete a FIDO2 Relying Party Resource, call the following endpoint: [DELETE ​/fido2-relying-parties​/{uuid}](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/FIDO2 Relying Parties/deleteRelyingPartyByIdUsingDELETE) The responses for this endpoint include the following: - 204: Delete operation successful. - 400: Input data errors. - 404: FIDO2 Relying Party not found. - 500: Internal error, sub-service failure, server crash. > It is not possible to delete the default Relying Party Resource.