Prerequisites
- Sandbox credentials: Ensure you have Prove Sandbox credentials from the Developer Portal. To access Sandbox credentials, follow the steps outlined on the Authentication page. To access the Prove API, use your OAuth 2.0 client ID and client secret. You can load these from environment variables or another method:
 
Token ExpirationThe OAuth token expires after 60 minutes, requiring you to get another token.
- Server-side SDK: Install the server-side SDK of your choice by running a command in your terminal, or by using a dependency management tool specific to your project.
 
- Client-side SDK: Install the client-side SDK of your choice by running a command in your terminal, or by using a dependency management tool specific to your project.
 
To integrate  solutions, you must use the client-side SDK.
- Web SDK
 - Android SDK
 - iOS SDK
 
Implement Prove Unified Authentication
To integrate the Prove Unified Authentication solution, you must use the client-side SDK.
- Prove Unified Authentication Using Prove's Possession
 - Prove Unified Authentication Using Customer-Supplied Possession
 
1
Determine Type of Flow
- Web SDK
 - Android SDK
 - iOS SDK
 
Determine if the customer is on a mobile or desktop browser using this example. If the 
isMobile is true, set mobile as the flowType for the Start() function on the server, otherwise you can set desktop:2
Initialize the Flow
Send a request to your back end server with the phone number and possession type to start the flow.Additional parameters:The function returns the following fields:
- 
finalTargetURL: required whenflowType=desktop. This should be a URL you maintain. Once the customer clicks the Instant Link, they will be redirected to this URL. It should instruct the customer to continue the workflow. Maximum length is 128 characters. - 
smsMessage: optional field to customize the message body sent in the Instant Link or OTP SMS message. Otherwise, you can use Prove defaults. - 
clientCustomerId: a client-generated unique ID for a specific customer. You can link calls related to the same customer, across different requests or sessions. The client defines the format of this ID. - 
clientRequestId: a client-generated unique ID for a specific session. You can identify specific requests using this field. You determine the format of this ID. - 
allowOTPRetry: set totrueto allow the customer to re-enter the OTP up to three times. Defaults tofalse.For OTP retries, make sure to implement client SDK changes in the next step. 
- 
authToken: send this to your client-side code to pass into theAuthenticate()function - it’s a short lived JSON Web Token (JWT) tied to the current flow and used for the possession checks. - 
correlationId: save this in your current session, then pass it in to theUnifyStatus()function call of the same flow. The correlation ID ties together different system calls for the same Prove flow. It also aids in troubleshooting. The session expires in 15 minutes from when the correlation ID returns from theUnify()call. - 
success: will returnpendingfor this initial call. 
authToken in a response to the front end.3
Authenticate
Once you have the To set the One-Time Password (OTP) handler, To set the Instant Link handler, In the desktop flow, a WebSocket opens for three minutes on the desktop browser while waiting for the customer to select the link in the text message. Once clicked, the WebSocket closes and the 
authToken, build the authenticator for both the mobile and desktop flows.- Web SDK
 - Android SDK
 - iOS SDK
 
Configure OTP
To use the Resend/Retry/Phone Change features, you need to install the Web SDK version 2.15.1 or later.
withOtpFallback(startStep: OtpStartStep | OtpStartStepFn, finishStep: OtpFinishStep | OtpFinishStepFn), requires implementing the OtpStartStep and OtpFinishStep. When returning the phone number in the functions, ensure you return an object with the field phoneNumber to the resolve() function.The OTP session has a two minute timeout from when it’s sent through Short Message Service (SMS) to when the customer can enter in the OTP.- Default
 - Prompt for Phone Number
 - Resend
 - Retry OTP
 - Phone Number Change
 
Follow these instructions if you are implementing OTP and you are passing in the phone number on the Call the 
/v3/start endpoint. In this case, you’ve already prompted for a phone number so you don’t need to prompt for it in the client SDK.Since you passed the phone number in the Start() function, call resolve(null) to communicate to the SDK you have the customer’s agreement to deliver the SMS message. Ensure you return an object to resolve() function.reject('some error message') method to communicate to the SDK any issues while trying to obtain the phone number or the OTP. Report an error if the customer cancels the SMS transaction or presses the back button to leave the screen.In the finish step, call the resolve(result: OtpFinishResult) method to return the collected OTP value in which result variable has OnSuccess value for OtpFinishResultType and the OTP value wrapped in OtpFinishInput.Configure Instant Link
To use the Resend/Retry/Phone Change features, you need to install the Web SDK version 2.15.1 or later.
withInstantLinkFallback(startStep: InstantLinkStartStep | InstantLinkStartStepFn, retryStep?: InstantLinkRetryStep | InstantLinkRetryStepFn) requires implementing the InstantLinkStartStep interface and optionally the InstantLinkRetryStep interface if you wish for advanced capabilities. When returning the phone number in the functions, ensure you return an object with the field phoneNumber to the resolve() function.The Instant Link session has a three minute timeout from when it’s sent through Short Message Service (SMS) to when the customer can click the received link.- Default
 - Prompt for Phone Number
 - Resend
 - Phone Number Change
 
Follow these instructions if you are implementing Instant Link and you are passing in the phone number on the 
/v3/start endpoint. In this case, you’ve already prompted for a phone number so you don’t need to prompt for it in the client SDK.Since you passed the phone number in the Start() function, call resolve(null) to communicate to the SDK you have the customer’s agreement to deliver the SMS message. Ensure you return an object to resolve() function.AuthFinishStep function finishes.If you’re using Content Security Policy headers, ensure you allow 
wss: device.uat.proveapis.com and wss: device.proveapis.com.4
Verify Mobile Number
In the The function returns the following fields:
AuthFinishStep, you’ll specify a function to call once the possession checks complete on the mobile phone. This endpoint on your back end server calls the UnifyStatus() function to validate the phone number. The AuthFinishStep then completes.- 
success: eithertrueif the mobile number validation was successful, orfalseif it failed. - 
phoneNumber: the phone number associated with the possession check. 
Test your Prove implementation
Next, reference the Sandbox test scenarios to test users and simulate different behaviors encountered in production.Production LaunchTo launch in Production, please contact your Prove representative.
Prove Key BehaviorThe following are things to be aware of when using the Prove Key:
- Prove Possession - Desktop
 - Prove Possession - Mobile
 - Customer-Supplied Possession
 
The Prove Key is ignored and Instant Link is performed.

