App-to-App ID&V
3 5 app-to-app identity verification 3 5 1 overview in mobile payment push provisioning, identity & verification id&v ensures that only the rightful cardholder can add their payment card to samsung wallet samsung wallet supports multiple id&v methods to prevent unauthorized access and fraud, including – sms, email, phone call, access code, bank website, app, or support, and app-to-app id&v app-to-app id&v allows users to verify their identity through their bank's mobile application during push provisioning samsung wallet supports following integration path using android intents does not require sdk – this guide focuses on this method note american express does not support app-to-app id&v 3 5 2 user experience the following figure illustrates the ui flow for app-to-app id&v when the user wants to add a payment card to samsung wallet and selects the “open banking app” option 3 5 3 implementing app-to-app id&v this method allows samsung wallet to launch a bank’s mobile app, where the user’s identity is verified before provisioning their payment card 3 5 4 key concepts term description id&v identity & verification – confirms the cardholder’s identity before provisioning a card tsp token service provider – handles tokenization and supplies id&v methods samsung tr samsung token requestor – communicates with the tsp on behalf of samsung wallet app-to-app id&v launches the bank’s app from samsung wallet to complete identity verification 3 5 5 app-to-app id&v process flow to verify their payment card in the samsung wallet application, the user must accept the terms and conditions, after which samsung wallet initiates token provision through the samsung token requestor tr from the trust service provider tsp the tsp provides samsung wallet with the available id&v methods and the data needed to perform user verification through your application when the user selects “open banking app” in samsung wallet, an android activity launches your application through an intent the intent contains information from the tsp server you can implement app-to-app id&v support in your banking application in 2 ways token activation through bank server - after user verification, the token is activated through your bank’s backend and tsp apis token activation through samsung wallet application - after user verification, your bank server returns an authorization code to samsung wallet, which is used to activate the token the samsung tr and tsp the following figure shows the app-to-app id&v process flow launch the application to launch your application, the samsung wallet application calls the startactivityforresult method, providing the following intent data from the tsp server package name of your application intent action, whose specific name depends on the tsp additional data in the intent extra_text key, depending on the card type mastercard a base64-encoded json object with the following elements paymentappproviderid, paymentappinstanceid, tokenuniquereference, accountpansuffix, and accountexpiry visa an encrypted json payload including pan id, tr id, token reference id, last 4 digits of pan, device id, and wallet account id intent data is generated with the getapp2appintent method in the samsung wallet application public intent getapp2appintent { intent app2appintent = new intent ; app2appintent setpackage packagename ; app2appintent setaction action ; if !textutils isempty extratext { app2appintent putextra intent extra_text, extratext ; } return intent; } note for information about the data in the intent extra_text key, refer to the card network’s own specifications the samsung wallet application only transfers the data to your application for handling process the id&v request to enable your application to handle the intent data transmitted from the samsung wallet application, in your “androidmanifest xml” file, define an activity with the intent action used by the tsp <activity android name="app2appidnvactivity"> <intent-filter> <action android name="com bank mobileapp action launch_a2a_idv"/> <category android name="android intent category default"/> </intent-filter> </activity> when your application is called by samsung wallet, start the activity to process the id&v request the data passed by the intent can be processed through your backend server along with other data that the application already has, such as user and account information if user verification is successful, you can activate the token by calling the tsp api return to samsung wallet after the user has completed verification, your application must direct the user back to samsung wallet using the activity setresult resultcode, resultintent method if the value of resultcode is result_ok, the resultintent object must contain extra bundle data the step_up_response key must have one of the following values depending on the scenario intent result = new intent ; // authentication successful result putextra "step_up_response", "accepted" ; // authentication failed; do not add the user’s card result putextra "step_up_response", "declined" ; // authentication failed; allow user to retry or select another id&v method result putextra "step_up_response", "failure" ; // authentication failed because the application was not ready result putextra "step_up_response", "appnotready" ; activity setresult result_ok, result ; to use an authentication code to activate the token in samsung wallet, you must also include the activation_code key-value intent result = new intent ; result putextra "step_up_response", "accepted" ; result putextra "activation_code", authcode ; activity setresult result_ok, result ; otherwise, the value of resultcode is result_cancel, when the user has canceled the operation intent result = new intent ; activity setresult result_cancel ; 3 5 6 samsung ui wallet flow the samsung wallet ui flow for push provisioning using app-to-app identity verification id&v refers to the sequence of user interface steps a user experience when adding a payment card and verifying their identity via their bank’s mobile app