> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/1kosmos-mobile-application/application-capabilities/authentication.md).

# Authentication

Authentication capabilities define how the 1Kosmos mobile app verifies a user during login. Each method addresses a different scenario, from default online flows to fully offline workstation access.

***

### Capabilities in this category

<table data-view="cards"><thead><tr><th></th></tr></thead><tbody><tr><td>Push notification authentication</td></tr><tr><td>QR code login</td></tr><tr><td>Touch ID / Face ID authentication</td></tr><tr><td>LiveID liveness detection</td></tr><tr><td>PIN authentication</td></tr></tbody></table>

***

### Push notification authentication

Approve or deny login requests with a single tap on a registered mobile device.

**What it does** — When a user initiates login on a workstation, web app, or any integrated system, a push notification is delivered to their device. The user opens the notification, sees contextual details (location, application, device type), and approves or denies the request after biometric or PIN verification.

**When to use it** — Default authentication method for online scenarios where users have a stable connection and a registered device. Recommended for workforce and consumer logins.

**Key details**

* Cryptographically signed responses using device-bound key pairs
* Contextual metadata shown for every request
* Requires Google Play Services on Android for delivery
* Falls back to QR or OTP if push is unavailable

***

### QR code login

Scan a QR code to authenticate to any 1Kosmos-integrated application.

**What it does** — A QR code displayed on a login page is scanned by the 1Kosmos app. The user authenticates locally with biometrics or PIN, and the requesting application is signed in instantly without typing a username or password.

**When to use it** — Cross-device authentication, kiosks, shared workstations, and consumer-facing flows where typing credentials is cumbersome.

**Key details**

* Works across iOS and Android
* No username or password required
* Embedded deep linking to the 1Kosmos app
* Used in both onboarding and ongoing authentication

***

### Legacy TOTP

Backward-compatible TOTP fallback for older 1Kosmos integrations.

**What it does** — Provides a separate TOTP code accessible from the menu, displayed in a full-screen view with a 30-second timer. When the standard OTP is unavailable on app launch, the legacy TOTP appears in red as an automatic fallback.

**When to use it** — Older 1Kosmos integrations or as a fallback when the primary OTP cannot be displayed for an account.

**Key details**

* Separate from the standard Workstation OTP
* Available under Menu → TOTP (Legacy)
* Visual indicator (red) when surfaced as a fallback

***

### Touch ID / Face ID authentication

Authenticate to the 1Kosmos app using device-native biometrics.

**What it does** — Validates the user against biometrics enrolled on the device's secure enclave. Required on every app launch and for confirming authentication actions within the app.

**When to use it** — Default biometric method for confirming any sensitive action — login approval, password reset, or document enrollment.

**Key details**

* Biometric data never leaves the device
* Validated by the OS-level secure enclave
* Works without internet connectivity
* Falls back to PIN if biometrics are unavailable or revoked

***

### LiveID liveness detection

Confirm the live presence of a real person via real-time selfie capture.

**What it does** — Captures a short selfie via the front camera and analyzes it for signs of liveness — confirming that a real person is present, not a photograph, video, or deepfake. Generates a high-assurance biometric assertion bound to the user's identity wallet.

**When to use it** — High-assurance scenarios such as Social Security Number enrollment, regulated identity proofing, and sensitive wallet operations like restoring on a new device.

**Key details**

* Anti-spoofing checks against photo, video, and screen replay attacks
* Required before SSN enrollment
* Required for QR-based wallet restoration
* Stored encrypted on-device; never transmitted in raw form

***

### PIN authentication

Eight-digit numeric PIN as a fallback credential for app access.

**What it does** — Serves as the universal fallback credential for unlocking the 1Kosmos app and authenticating sensitive actions when biometrics are unavailable.

**When to use it** — Devices without biometric capabilities, after biometric revocation, or when biometric authentication fails.

**Key details**

* Required during initial app setup
* 8-digit numeric format
* Triggers app reset after 10 consecutive incorrect attempts (Android counts PIN and biometric failures; iOS counts only PIN failures)
* Permanently deletes all wallet data on reset

{% hint style="warning" %}
**App reset is permanent.** When triggered, all accounts and wallet data on the device are deleted. Make sure to back up your 12-word recovery mnemonic before this happens.
{% endhint %}

### Method support matrix

| Capability         | Online | Offline | iOS | Android | Android (no GMS) |
| ------------------ | :----: | :-----: | :-: | :-----: | :--------------: |
| Push notification  |    ✅   |    ❌    |  ✅  |    ✅    |         ❌        |
| QR code login      |    ✅   |    —    |  ✅  |    ✅    |         ✅        |
| Workstation OTP    |    ✅   |    ✅    |  ✅  |    ✅    |         ✅        |
| Legacy TOTP        |    ✅   |    ✅    |  ✅  |    ✅    |         ✅        |
| Touch ID / Face ID |    ✅   |    ✅    |  ✅  |    ✅    |         ✅        |
| LiveID             |    ✅   |    ❌    |  ✅  |    ✅    |         ✅        |
| PIN                |    ✅   |    ✅    |  ✅  |    ✅    |         ✅        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/1kosmos-mobile-application/application-capabilities/authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.