# Authentication Module

<WebSDK2 />

The Authentication module re-authenticates a returning user by capturing a fresh selfie and matching it against their previously stored biometric record. Used for re-entry into an existing identity (versus the first-time identity verification done by [Selfie](doc:web-sdk-2-module-selfie-1) + [Face Match](doc:web-sdk-2-module-face-match)).

> Follows the [camera-capture pattern](doc:web-sdk-2-module-patterns#2-camera-capture-modules). The lifecycle and capture sub-states are identical to Selfie since both use the same underlying face-capture machinery (`BaseFaceCaptureConfig`).

## Availability

This module is headless-only — there is no public `<incode-authentication>` web component. Drive it with `createAuthenticationManager` from `@incodetech/core/authentication` and use the same UI patterns as Selfie.

## Configuration

`AuthenticationConfig` is the intersection of the dashboard-driven `FlowModuleConfig['AUTHENTICATION']` and the shared `BaseFaceCaptureConfig`:

```typescript
type AuthenticationConfig = FlowModuleConfig['AUTHENTICATION'] & BaseFaceCaptureConfig;
```

The dashboard fields are similar to Selfie's: `showTutorial`, `autoCaptureTimeout`, `numberOfAttempts`, `type` (always `'ONE_TO_ONE'` for re-auth), `deepsightLiveness`, plus the validate-* booleans (`validateClosedEyes`, `validateFaceMask`, `validateHeadCover`, `validateLenses`).

For the full config catalogue see [Module: Selfie → Configuration Options](doc:web-sdk-2-module-selfie-1#configuration-options) — the same fields apply.

| Option                                 | Type      | Required | Description                                                                                                                                                                                                                                                                              |
| -------------------------------------- | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `onDeviceFaceResultsSubmissionEnabled` | `boolean` | ❌        | Opt-in. When `true`, face analysis runs entirely on-device and only the results are submitted to the server. Has E2EE and WASM-pipeline prerequisites — see [On-Device Face Capture](doc:web-sdk-2-on-device-face-capture) for the full walkthrough. Leave off to keep the legacy server-side path. |

## State machine

`AuthenticationState` follows the same shape as `SelfieState` — see [Module: Selfie → States Reference](doc:web-sdk-2-module-selfie-1#states-reference) for the full list. The states are:

`idle`, `loading`, `tutorial`, `permissions`, `capture`, `processing`, `finished`, `closed`, `error`.

## API methods

Identical to the Selfie manager API: `load`, `nextStep`, `requestPermission`, `goToLearnMore`, `back`, `capture`, `retryCapture`, `close`, plus the universal lifecycle (`subscribe`, `getState`, `reset`, `stop`).

See [Module: Selfie → API Methods](doc:web-sdk-2-module-selfie-1#api-methods) for the full reference.

## WASM requirement

Authentication uses the same selfie ML pipeline as the Selfie module. Preload via `setup({ wasm: { pipelines: ['selfie'] } })`.

## See also

* [Module: Selfie](doc:web-sdk-2-module-selfie-1): first-time identity capture
* [Module: Face Match](doc:web-sdk-2-module-face-match): selfie ↔ ID comparison for first-time verification
* [Module: Identity Reuse](doc:web-sdk-2-module-identity-reuse): different flow for returning-user identification
* [Module Patterns → camera-capture](doc:web-sdk-2-module-patterns#2-camera-capture-modules)
* [WASM Configuration](doc:web-sdk-2-wasm)