Question 1

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

Accepted Answer

The Hypermedia Authentication API (HAAPI) is part of the product and is enabled by default for all paid editions of the Curity Identity Server.

Question 2

How do I enable the Hypermedia Authentication API?

Accepted Answer

The Hypermedia Authentication API (HAAPI) is enabled by default in the Curity Identity Server, for all paid editions.

Question 3

Does the Hypermedia Authentication API follow the OAuth standard?

Accepted Answer

Yes, the Hypermedia Authentication API (HAAPI) is OAuth compliant.

Question 4

Are PKCE, OAuth assistant etc still necessary if we start to use the Hypermedia Authentication API?

Accepted Answer

The Hypermedia Authentication API provides high security through client attestation and sender-constrained tokens. If you decide to provide authentication in your applications using HAAPI, then you can drop the usual solutions used because of browser vulnerabilities (as now no browser is used in the flow).

Question 5

Is it actually ok to enter credentials in the app? I thought the recommendation was not to do that.

Accepted Answer

Credentials can be entered in the app if it is a first-party application. Then the same entity owns both the application and credentials, so this is not against recommendations. For third-party apps that use HAAPI, you should only use authentication methods that do not require entering credentials in the app (e.g., use an e-mail link).

Question 6

We have existing user-facing authentication actions. What happens with that flow if we use the Hypermedia Authentication API?

Accepted Answer

Everything that can be rendered server side can also be used via the Hypermedia Authentication API (HAAPI).

Question 7

Will the Hypermedia Authentication API work for all mobile users?

Accepted Answer

Yes, HAAPI works on all modern mobile devices. It also provides a fallback method for devices that do not support client attestation (e.g., phones with Android version less than 8.0.)

Question 8

How can the Hypermedia Authetication API be used for mobile?

Accepted Answer

On mobile, user authentication and login can be done without leaving the app or involving a browser. Client attestation ensures it’s secure, and the API only communicates with a genuine client (app).

Question 9

What type of authentication can be used?

Accepted Answer

You can use all types of authentication. If the authentication requires the user to leave the API flow, e.g., federation, the step on how to proceed will be presented. Once done, the HAAPI flow will continue.

Question 10

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

Accepted Answer

The Hypermedia Authentication API (HAAPI) is part of the product and is enabled by default for all paid editions of the Curity Identity Server.

Question 11

Can the Hypermedia Authentication API only be used on mobile (iOS and Android)?

Accepted Answer

In addition to mobile, you can also use the Hypermedia Authentication API (HAAPI) for Single Page Applications to create a smooth authentication experience.

Question 12

Is there a way to handle rooted mobile devices?

Accepted Answer

Yes. The configuration specifies which security levels should be used. Rooted devices are one of these settings. In production, it is strongly recommended not to allow rooted devices.

Seamless User Authentication

The Perfect Match for Single Page Applications

A Streamlined User Experience

Secure multi-factor authentication done within the app

Your customer never leaves your brand

Easy user login from any device or browser

Common Use Cases

Mobile Apps

API/Resource Server

Why Curity Authentication API?

OAuth & OpenID Connect compliant

Client attestation for increased security

No browser required

Full Control over Every Step in the Authentication Flow

True Native Mobile Experiences

Protect your business apps and APIs

SDKs Available for iOS, Android and Web

Authenticators

Actions

Branding

Frequently Asked Questions

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

How do I enable the Hypermedia Authentication API?

Does the Hypermedia Authentication API follow the OAuth standard?

Are PKCE, OAuth assistant etc still necessary if we start to use the Hypermedia Authentication API?

Is it actually ok to enter credentials in the app? I thought the recommendation was not to do that.

We have existing user-facing authentication actions. What happens with that flow if we use the Hypermedia Authentication API?

Will the Hypermedia Authentication API work for all mobile users?

How can the Hypermedia Authetication API be used for mobile?

What type of authentication can be used?

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

Can the Hypermedia Authentication API only be used on mobile (iOS and Android)?

Is there a way to handle rooted mobile devices?

See Curity Identity Server in action

Seamless User Authentication

The Perfect Match for Single Page Applications

A Streamlined User Experience

Secure multi-factor authentication done within the app

Your customer never leaves your brand

Easy user login from any device or browser

Common Use Cases

Mobile Apps

API/Resource Server

Why Curity Authentication API?

OAuth & OpenID Connect compliant

Client attestation for increased security

No browser required

Full Control over Every Step in the Authentication Flow

True Native Mobile Experiences

Protect your business apps and APIs

SDKs Available for iOS, Android and Web

Authenticators

Actions

Branding

Frequently Asked Questions

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

How do I enable the Hypermedia Authentication API?

Does the Hypermedia Authentication API follow the OAuth standard?

Are PKCE, OAuth assistant etc still necessary if we start to use the Hypermedia Authentication API?

Is it actually ok to enter credentials in the app? I thought the recommendation was not to do that.

We have existing user-facing authentication actions. What happens with that flow if we use the Hypermedia Authentication API?

Will the Hypermedia Authentication API work for all mobile users?

How can the Hypermedia Authetication API be used for mobile?

What type of authentication can be used?

Is the Hypermedia Authentication API a part of the Curity Identity Server or is it a separate product?

Can the Hypermedia Authentication API only be used on mobile (iOS and Android)?

Is there a way to handle rooted mobile devices?

See Curity Identity Server in action

More in