README

LoginID - Web SDK

Description

The LoginID Web SDK enables you to add FIDO2 certified multi-factor authentication to your web-based application all the while having full control over the user experience with no redirection to pages outside your application. LoginID leverages the biometrics or however the device is unlocked (e.g. PIN for Windows Hello) on the end user's device to create a seamless process for secure passwordless authentication. Additionally, LoginID offers Transaction Confirmation, where a transaction can be cryptographically signed providing proof of the user’s confirmation of that specific transaction, which is perfect for merchants who want payment authentication services as well. LoginID is aligned withPSD2, GDPR, CCPA, and HIPPA.

For more robust functionality, it is recommended that you also leverage a Server SDK. If your backend is written in something other than Node, check out our documentation for other options. The Server SDK makes requests to LoginID's API easier by leveraging an API Credential to perform sensitive operations, such as adding managing authenticators. Check out the LoginID Server SDK for a simplified integration.

NPM:

import WebSDK from '@loginid/sdk';
const sdk = new WebSDK("BASE_URL", "CLIENT_ID");

HTML:

<!-- Import module from the JS SDK -->
<script src="./src/vendor/loginid.web.min.js"></script>
<script>
    const sdk = new LoginID.web.default(
        "BASE_URL", "CLIENT_ID"
    );
    // ...
</script>

To complete an end-to-end FIDO experience for your user, we strongly recommend enabling the following flows in your application.

NOTE: To use LoginID endpoints needed for the below flows, you will either need to:

Use our server SDK or
Call our APIs directly using your server implementation. Please note, for this option you will need to generate an API Service Token.

Account Recovery

Users regularly lose or upgrade their devices, which can be a problem in the FIDO space as the credential is tied to the device. We strongly recommend encouraging your users to register multiple devices, though there may be cases where this cannot happen.

Add New Authenticator

The majority of customers have multiple devices, and they expect to be able to access your application from all of them. In order to add this new device securely, a previously registered device is required to authorize the new device.

One-Time Authentication

Some customers may want to log in on devices which either do not support FIDO, or a device which they do not own. In order to access this new device securely, a previously registered device is required to authorize the new device.

Tell us how we’re doing

Have our solution in production? Tell us about your site on marketing@loginid.io and we’ll post on our social channels!

Usage no npm install needed!