Authentication Module

Note

This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation here. Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade.

Full rollout to all clients still TBD.

The Authentication module re-authenticates a returning user by capturing a fresh selfie and matching it against their previously stored biometric record. Used for re-entry into an existing identity (versus the first-time identity verification done by Selfie + Face Match).

Follows the camera-capture pattern. The lifecycle and capture sub-states are identical to Selfie since both use the same underlying face-capture machinery (BaseFaceCaptureConfig).

Availability

This module is headless-only — there is no public <incode-authentication> web component. Drive it with createAuthenticationManager from @incodetech/core/authentication and use the same UI patterns as Selfie.

Configuration

AuthenticationConfig is the intersection of the dashboard-driven FlowModuleConfig['AUTHENTICATION'] and the shared BaseFaceCaptureConfig:

type AuthenticationConfig = FlowModuleConfig['AUTHENTICATION'] &
  BaseFaceCaptureConfig;

The dashboard fields are similar to Selfie's: showTutorial, autoCaptureTimeout, numberOfAttempts, type (always 'ONE_TO_ONE' for re-auth), deepsightLiveness, plus the validate-* booleans (validateClosedEyes, validateFaceMask, validateHeadCover, validateLenses).

This page inherits the Selfie capture-config table. AuthenticationConfig intersects BaseFaceCaptureConfig, the same type Selfie uses, so every shared capture field is valid here too — showPreview, assistedOnboarding, enableFaceRecording, captureAttempts, validateBrightness, cameraResolution, ageAssurance, and recording among them. See Module: Selfie → Configuration Options for their types and defaults rather than a second copy here.

The table below covers only the fields worth calling out for re-authentication; it is not the complete list.

Option	Type	Required	Description
`onDeviceFaceResultsSubmissionEnabled`	`boolean`	❌	Opt-in. When `true`, face analysis runs entirely on-device and only the results are submitted to the server. Has E2EE and WASM-pipeline prerequisites — see On-Device Face Capture for the full walkthrough. Leave off to keep the legacy server-side path.
`selfieConcealmentOption`	`'OPTION_NONE' \| 'OPTION_SILHOUETTE' \| 'OPTION_2D' \| 'OPTION_3D'`	❌	Conceals the on-screen camera preview with a cosmetic avatar. Display-only — detection, quality, liveness, and upload run on the real frames. See Module: Selfie → Face concealment. Default `OPTION_NONE`.
`avatarAssets`	`AvatarAssetsOverrides`	❌	Where to load the avatar runtime from when `selfieConcealmentOption` selects an avatar. See Module: Selfie → Self-hosting the avatar runtime.

State machine

AuthenticationState follows the same shape as SelfieState — see Module: Selfie → States Reference for the full list. The states are:

idle, loading, tutorial, permissions, capture, processing, finished, closed, error.

API methods

Identical to the Selfie manager API: load, nextStep, requestPermission, goToLearnMore, back, capture, retryCapture, close, plus the universal lifecycle (subscribe, getState, reset, stop).

See Module: Selfie → API Methods for the full reference.

WASM requirement

Authentication uses the same selfie ML pipeline as the Selfie module. Preload via setup({ wasm: { pipelines: ['selfie'] } }).