Authentication, MFA, and Passwordless
Nevis ID authenticates external users (consumers, citizens, and business partners) with passkeys (FIDO2/WebAuthn), app-based FIDO UAF authentication through the fully branded Nevis Access App or the Mobile Authentication SDK embedded in your own app, OATH TOTP, OTP over email and SMS, and passwords; Nevis is FIDO2 certified and FIDO UAF 1.1 certified. Phishing-resistant passwordless login covers push approval with number matching, cross-device login via QR code, app links, and transaction confirmation (WYSIWYS) for strong customer authentication (SCA) under PSD2. Risk signals drive step-up authentication for sensitive operations and help prevent account takeover (ATO). Users restore access through self-service account recovery using recovery codes, OTP channels, account linking (Google, Microsoft, Apple), or E-ID based flows, which reduces help-desk dependency.
Also known as
passwordless, passkeys, FIDO2/WebAuthn, FIDO UAF, phishing-resistant MFA, SCA, step-up, ATO prevention, transaction signing, account recovery.
At a glance
| Capability | Details |
|---|---|
| Passkeys (FIDO2/WebAuthn) | Passwordless and usernameless sign-in and onboarding, on the web and in mobile apps |
| App-based authentication (FIDO UAF) | Fully branded Nevis Access App as a turnkey authenticator, or the Mobile Authentication SDK embedded in your own iOS, Android, Flutter, or React Native app |
| Out-of-band channels | Push notification, QR code (cross-device), app link (same device), fetch (push-free); number matching against MFA fatigue |
| Transaction confirmation | FIDO UAF transaction signing (WYSIWYS) for payment approval and SCA under PSD2 |
| Local authenticators | App PIN, fingerprint, Face ID, Touch ID, Android biometrics, device passcode; keys are hardware-bound (TEE, Secure Enclave, StrongBox) |
| OTP and TOTP | OATH TOTP authenticator apps, OTP over email (eTAN) and SMS (mTAN) |
| Passwords | Password login with configurable policies and breached-credential checks (credential intelligence) |
| Step-up authentication | Risk-driven session upgrade for sensitive operations; see also Risk, Fraud, and Adaptive Access |
| Account recovery | Self-service recovery with recovery codes, OTP channels, URL tickets, account linking (Google, Microsoft, Apple), and E-ID flows; hardware-bound mobile keys are never backed up, so a lost device is deregistered and re-onboarded |
| Standards and certification | FIDO2/WebAuthn, FIDO UAF 1.1, OATH; FIDO2 certified and FIDO UAF 1.1 certified |
Concepts
The Nevis Access App and Mobile Authentication SDK documentation is shared across Nevis products.
- Mobile Authentication SDK feature overview: FIDO UAF based passwordless and usernameless authentication, multi-account, multi-device, multi-backend
- Communication channels: in-band and out-of-band authentication over push, QR code, links, and fetch
- Authenticators: PIN, password, biometrics, and device passcode compared, including where key material lives
- The four FIDO UAF operations: registration, authentication, transaction confirmation, and deregistration
- Key protection: secure storage in TEE, Secure Enclave, and Android StrongBox
- Security considerations: threat model, SDK hardening, device loss, and app attestation
- Nevis Access App: the brandable authenticator app, covering channels, transaction confirmation, number matching, and app attestation
How-to Guides
- Sign in with a passkey
- Onboard with a passkey
- Onboard with additional authentication factors
- Set up adaptive authentication and step-up
- Check credentials against breach data
- Order and brand an Access App and set up push support
- Integrate the Mobile Authentication SDK: quickstart, configuration, and the registration and authentication operations
References
- Integration patterns: FIDO2 Authentication, FIDO2 Onboarding, Out-of-band Mobile Authentication, Usernameless Out-of-band Mobile Authentication, Transaction Confirmation Service, OATH Authentication, Mobile TAN (mTAN), Email TAN (eTAN), nevisIDM Password Login, Advanced Session Upgrade
- Recovery patterns: nevisIDM Recovery Code Onboarding, nevisIDM Recovery Code Authentication, nevisIDM URL Ticket Consume, nevisIDM Second-Factor Onboarding
- Passkey and mobile authentication APIs: WebAuthn / Passkey (FIDO2), Mobile Authentication (FIDO UAF), Mobile signature
- OTP APIs: OTP, OATH, mTAN, TAN
- Password and policy APIs: Password, Policies
- Account recovery APIs: Recovery code, URL ticket, PUK, Temporary strong password, Personal question
- Session APIs: Session management
- Mobile Authentication SDK API references: Android, iOS, Flutter, and React Native
- Access App authenticators and supported platforms and requirements
- System overview: architecture, endpoints, and environments