What are Challenges

🔐 What Are Challenges?

A challenge is a security step a user must complete for authentication or verification. Common types include:

• 🔢 OTP (SMS, Email)
• 📷 Selfie or Document Scan (IDV)
• 🧬 Biometric (Fingerprint, Face ID)
• 🔐 Device-based (Confirmation of a known device)

Challenges are triggered during flows like:

• Activation (first-time setup)
• Login (same/new device)
• Password recovery
• Transaction approvals

⚙️ How They Work

1. Configured in Gateway Manager
   Admins define which challenges are active, their order, and which are mandatory or optional.

2. Triggered via SDK
   The mobile SDK initiates and handles each challenge step-by-step based on server response.

3. Controlled via Events
   Each challenge emits specific SDK events that the application must listen for and respond to.

🔄 Challenge Attempt Cooling Period in REL-ID SDK

This document explains how the cooling period (retry delay or lockout duration) is managed when users fail authentication challenges such as password, PIN, OTP, or custom challenges in the REL-ID SDK.

📘 SDK Behavior

• The REL-ID SDK does not enforce a hardcoded cooling period.
• Instead, cooling period and retry behavior are governed by server-side policies configured via the REL-ID Gateway Manager.

⚙️ Admin-Configurable Settings

Configuration for retry and lockout behavior is done under:

REL-ID Gateway Manager → Group Management → Challenge Category Configuration

Or:

Challenge Handling Configurations → Challenge Attempt Policy

Key Parameters:

🚫 What Happens on Final Failure

• SDK receives statusCode = 166 indicating user account is locked
• SDK calls getUser() to fetch latest status
• App must handle this by showing a lockout message or triggering unblocking flow

🧠 Developer Guidelines

• Always monitor onGetUserResult() or equivalent callbacks for statusCode = 166
• Use getUser() to poll or validate if the lock period has passed
• Optionally invoke getUnblockUser() if supported

📝 Example User Message

“You have exceeded the maximum number of allowed attempts. Please try again after 15 minutes or contact your administrator to unlock your account.”

💡

Tip: Your app should be designed to dynamically respond to challenges as they are returned by the server — avoid hardcoding workflows.

🧩 Developer Responsibilities

✅ Implement all challenge handlers from the SDK (e.g., getPassword, getSMSOTP)
✅ Respond to callbacks promptly with user inputs ✅ Customize UI/UX for each challenge type ✅ Report challenge results back using APIs like setSMSOTP(), setSecretQuestionAnswer(), etc. ✅ Ensure error handling and retries where applicable