# Authenticate cardholders for transactions

You can perform out-of-band (OOB) 3D Secure cardholder authentication for digital transactions in your mobile app, using the OOB Android SDK or iOS SDK.
OOB authentication is a type of two-factor authentication (2FA).

---

## Before you start

You must:

1. Complete your [Issuing onboarding](https://www.checkout.com/docs/card-issuing/set-up-card-program.md).
2. Integrate the OOB [Android SDK](https://www.checkout.com/docs/developer-resources/sdks/card-issuing-sdks/out-of-band-authentication-android-sdk.md) or [iOS SDK](https://www.checkout.com/docs/developer-resources/sdks/card-issuing-sdks/out-of-band-authentication-ios-sdk.md).

---

## How it works

Once you have completed the setup, the flow to authenticate cardholders is as follows:

1. Perform Strong Customer Authentication (SCA).
2. Register the cardholder's device.
3. Authenticate the transaction.

---

## Perform Strong Customer Authentication

Perform [SCA](https://www.checkout.com/docs/business-operations/ensure-regulatory-compliance/sca-compliance.md) on the cardholder.

You can generate multiple tokens for different systems during a single authentication session. For example, for sign in, to get an SDK session token, or to get an internal authentication token.

However, you can only generate a single SDK session token for each SCA flow requested.

---

## Register the device

Register the cardholder's device and app for OOB. This is also known as device-binding.

You can choose to register the device as a background process when you onboard the cardholder in your app, or offer an explicit option to do so. For example, by displaying a button.

> **Note**
>
> You can only register a card for OOB for a single device and app combination. If you register another device for the same card, it overwrites the previously registered device and app combination.

For the iOS SDK, you must be in an asynchronous context to call the SDK's async functions – for example, you can use a `Task`.

To register the cardholder's device:

**Android SDK**

```kotlin
// Prepare the device registration request
val deviceRegistrationRequest = DeviceRegistration(
    token = "CardHolder access token",
    cardId = "CardID",
    applicationID =  "Unique Application ID",
    phoneNumber = PhoneNumber(countryCode = "+230", number = "52520782"), // Phone number is optional
    cardLocale = CardLocale.EN,
)

// Initialize device registration with the OOB SDK
val registerDeviceResult = oobManager.registerDevice(deviceRegistrationRequest)
registerDeviceResult.collect { result ->
    result.onSuccess {
        // Success result (Type:Unit)
    }.onFailure {
        val message = provideErrorMessage(it)
        // Handle errors here
    }
}
```

**iOS SDK**

```swift
// You must be in an async context to call the SDK's async functions – for example, use a Task
Task {
  do {
    let deviceRegistration = try CheckoutOOB.DeviceRegistration(token: "access_token",
            cardID: "card_id", // Maximum 30 characters
            applicationID: "application_id", // Likely the same as your notification token, which you can retrieve from your back end
            phoneNumber: CheckoutOOB.PhoneNumber(countryCode: "+44", number: "5006007080"), // Phone number is optional
            locale: .english) // or `.french`

    try await checkoutOOB.registerDevice(with: deviceRegistration)

  } catch  {
    print(error.localizedDescription)
  }
}
```

---

## Authenticate the transaction

In the core authentication flow, the cardholder is presented the option to approve or reject the transaction in your app.

1. Perform SCA on the cardholder again.
2. Listen for the transaction details webhook you set up for the [Android SDK](https://www.checkout.com/docs/developer-resources/sdks/card-issuing-sdks/out-of-band-authentication-android-sdk.md#Transaction_details_webhook) or [iOS SDK](https://www.checkout.com/docs/developer-resources/sdks/card-issuing-sdks/out-of-band-authentication-ios-sdk.md#Transaction_details_webhook).
3. Inject the transaction details into the OOB SDK.
4. Verify the online card transaction performed by your cardholder.

**Android SDK**

```kotlin
// Prepare the authentication request
val authenticationRequest = Authentication(
    transactionId = "Acs Transaction ID",
    token = "CardHolder access token",
    cardId = "cardID",
    method = Method.OOB_BIOMETRICS,
    decision = Decision.ACCEPTED,
)

// Initialize transaction authentication with the OOB SDK
val authenticatePaymentResult = oobManager.authenticatePayment(data)
authenticatePaymentResult.collect { result ->
    result.onSuccess {
        // Success result (Type:Unit)
    }.onFailure {
        val message = provideErrorMessage(it)
        // Handle errors here
   }
}
```

**iOS SDK**

```swift
Task {
  do {
    let paymentAuthentication = try CheckoutOOB.Authentication(token: "access_token",
                                                    cardID: "card_id", // 30 characters maximum
                                                    transactionID: "transaction_id",
                                                    method: .biometrics,
                                                    decision: .accepted)

    try await checkoutOOB.authenticatePayment(with: paymentAuthentication)

    } catch {
      print(error.localizedDescription)
    }
}
```