---
title: "Authentication Module"
url: "https://developer.incode.com/sdk-reference/web-sdk-2-module-authentication/"
section: "sdk-reference"
group: "Incode Web SDK 2 Reference / Web SDK 2 Individual Modules"
version: "v1.1"
status: "live"
---
# Authentication Module

:::note
This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation [here](/sdk-reference/web-sdk-reference).  Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade. <br /><br />Full rollout to all clients still TBD.
:::

The Authentication module re-authenticates a returning user by capturing a fresh selfie and matching it against their previously stored biometric record. Used for re-entry into an existing identity (versus the first-time identity verification done by [Selfie](/sdk-reference/web-sdk-2-module-selfie-1/) + [Face Match](/sdk-reference/web-sdk-2-module-face-match/)).

> Follows the [camera-capture pattern](/sdk-reference/web-sdk-2-module-patterns/#2-camera-capture-modules). The lifecycle and capture sub-states are identical to Selfie since both use the same underlying face-capture machinery (`BaseFaceCaptureConfig`).

## Availability

This module is headless-only — there is no public `<incode-authentication>` web component. Drive it with `createAuthenticationManager` from `@incodetech/core/authentication` and use the same UI patterns as Selfie.

## Configuration

`AuthenticationConfig` is the intersection of the dashboard-driven `FlowModuleConfig['AUTHENTICATION']` and the shared `BaseFaceCaptureConfig`:

```typescript
type AuthenticationConfig = FlowModuleConfig['AUTHENTICATION'] &
  BaseFaceCaptureConfig;
```

The dashboard fields are similar to Selfie's: `showTutorial`, `autoCaptureTimeout`, `numberOfAttempts`, `type` (always `'ONE_TO_ONE'` for re-auth), `deepsightLiveness`, plus the validate-\* booleans (`validateClosedEyes`, `validateFaceMask`, `validateHeadCover`, `validateLenses`).

**This page inherits the Selfie capture-config table.** `AuthenticationConfig` intersects `BaseFaceCaptureConfig`, the same type Selfie uses, so every shared capture field is valid here too — `showPreview`, `assistedOnboarding`, `enableFaceRecording`, `captureAttempts`, `validateBrightness`, `cameraResolution`, `ageAssurance`, and `recording` among them. See [Module: Selfie → Configuration Options](/sdk-reference/web-sdk-2-module-selfie-1/#configuration-options) for their types and defaults rather than a second copy here.

The table below covers only the fields worth calling out for re-authentication; it is not the complete list.

| Option                                 | Type                                                                 | Required | Description                                                                                                                                                                                                                                                                                         |
| -------------------------------------- | -------------------------------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `onDeviceFaceResultsSubmissionEnabled` | `boolean`                                                            | ❌        | Opt-in. When `true`, face analysis runs entirely on-device and only the results are submitted to the server. Has E2EE and WASM-pipeline prerequisites — see [On-Device Face Capture](/sdk-reference/web-sdk-2-on-device-face-capture/) for the full walkthrough. Leave off to keep the legacy server-side path. |
| `selfieConcealmentOption`              | `'OPTION_NONE' \| 'OPTION_SILHOUETTE' \| 'OPTION_2D' \| 'OPTION_3D'` | ❌        | Conceals the on-screen camera preview with a cosmetic avatar. Display-only — detection, quality, liveness, and upload run on the real frames. See [Module: Selfie → Face concealment](/sdk-reference/web-sdk-2-module-selfie-1/#face-concealment). Default `OPTION_NONE`.                                       |
| `avatarAssets`                         | `AvatarAssetsOverrides`                                              | ❌        | Where to load the avatar runtime from when `selfieConcealmentOption` selects an avatar. See [Module: Selfie → Self-hosting the avatar runtime](/sdk-reference/web-sdk-2-module-selfie-1/#self-hosting-the-avatar-runtime).                                                                                      |

## State machine

`AuthenticationState` follows the same shape as `SelfieState` — see [Module: Selfie → States Reference](/sdk-reference/web-sdk-2-module-selfie-1/#states-reference) for the full list. The states are:

`idle`, `loading`, `tutorial`, `permissions`, `capture`, `processing`, `finished`, `closed`, `error`.

## API methods

Identical to the Selfie manager API: `load`, `nextStep`, `requestPermission`, `goToLearnMore`, `back`, `capture`, `retryCapture`, `close`, plus the universal lifecycle (`subscribe`, `getState`, `reset`, `stop`).

See [Module: Selfie → API Methods](/sdk-reference/web-sdk-2-module-selfie-1/#api-methods) for the full reference.

## WASM requirement

Authentication uses the same selfie ML pipeline as the Selfie module. Preload via `setup({ wasm: { pipelines: ['selfie'] } })`.

## See also

- [Module: Selfie](/sdk-reference/web-sdk-2-module-selfie-1/): first-time identity capture
- [Module: Face Match](/sdk-reference/web-sdk-2-module-face-match/): selfie ↔ ID comparison for first-time verification
- [Module: Identity Reuse](/sdk-reference/web-sdk-2-module-identity-reuse/): different flow for returning-user identification
- [Module Patterns → camera-capture](/sdk-reference/web-sdk-2-module-patterns/#2-camera-capture-modules)
- [WASM Configuration](/sdk-reference/web-sdk-2-wasm/)