Out-of-band (OOB) authentication allows your users to employ a mobile device to authenticate from other devices such as desktop applications, browsers, Interactive Voice Response (IVR), or ATM machines. In this form of authentication, a laptop user typically authenticates to a web application using their mobile device. The user binds the browser session to his or her mobile device by scanning a QR code using the mobile device or by triggering a push notification. The user then performs FIDO authentication on an out-of-band channel between the mobile device and the Nok Nok Authentication Server. Once the user authenticates successfully, the Authentication Server notifies your app. OOB is a proprietary feature developed by Nok Nok on top of the FIDO protocol.
You can implement OOB on Android devices using modules that rely on either Google Play services or Huawei Mobile Services.
Using QR Codes
.png?sv=2026-02-06&spr=https&st=2026-10-01T07%3A16%3A59Z&se=2026-10-01T07%3A27%3A59Z&sr=c&sp=r&sig=pSx8jKILLv44oJC7ICqUK%2BFS6i5lbL5FqDqd9Lupv9I%3D)
Figure 9 Out-of-band Authentication Using QR Codes
Using Push Notification
.png?sv=2026-02-06&spr=https&st=2026-10-01T07%3A16%3A59Z&se=2026-10-01T07%3A27%3A59Z&sr=c&sp=r&sig=pSx8jKILLv44oJC7ICqUK%2BFS6i5lbL5FqDqd9Lupv9I%3D)
Figure 10 Out-of-Band Authentication Using Push Notifications
OOB requires implementing a web app and a mobile app. The web app displays a QR code or sends a push notification. The mobile app scans the QR code or responds to the push notification, then prompts the user to authenticate. You have 2 choices that allow you to immediately leverage OOB without incurring any Client development:
Newer mobile phones with a camera and FIDO2-compatible browser can use the on-device camera to scan a QR code to authenticate. No native app is required.
Users can install the Nok Nok Passport App, available from the Google Play Store and the Apple App Store, to scan a QR code or respond to a push notification. If you prefer an OEM branded experience for end-users, Nok Nok provides a customization package for Passport App.
OOB enables a provisioning feature called device blessing, a QR code-based mechanism that allows a user to initiate registration on a new device by using a previously registered device. This eliminates the inconvenience and security risk when a user is forced to recall and enter a password multiple times. To use device blessing, a user simply uses their new device to scan a QR code displayed on an existing device.