Skip to main content

Overview

LoginRadius PIN Authentication adds an additional layer of security to user’s accounts by allowing a PIN to be set during registration, login, or post-login events. It is designed to work alongside primary authentication methods such as password or social login, enabling multi-layered authentication and re-authentication scenarios using a separate Session Token.

⚠️ PIN Authentication is not a standalone feature—it always requires a first-level authentication method to be in place.

PIN Authentication allows users to secure sensitive actions or provide an additional login step. Once a PIN is set, users can authenticate with their PIN during login sessions or re-authenticate when performing specific operations within your application.

This mechanism uses Session Tokens distinct from Access Tokens, enabling flexible, token-based workflows for PIN-authenticated sessions.

Key Features and Use Cases

  • Secondary Authentication Layer - Enable PIN entry after primary login to strengthen security.
  • Session Token-Based Flow - A separate token used for PIN-based workflows allows controlled access without needing repeated complete logins.
  • Optional or Mandatory Setup - Choose whether PIN setup is required during registration, login, or first login.
  • Flexible Event Configuration - Define when the PIN is requested - during registration, login, or first login.
  • Change and Reset Workflows - Support for changing or resetting PINs via email, phone, or security questions.

Common Session API Endpoints

The following APIs form the core of the PIN Authentication workflow and are frequently used across multiple scenarios, including login, PIN setup, and session validation. These endpoints provide the foundation for implementing secure and flexible PIN-based authentication within your application.

This API will authenticate users directly with their PIN, offering a secure and passwordless login experience.

EndpointDescription
Login By PINAuthenticate users by having them submit their PIN. If this is successful, it returns a valid access token for subsequent requests.

Best Practices

  • Set a shorter expiration for session tokens to reduce misuse.
  • Always confirm whether the PIN is required or optional in your schema and workflow.
  • Use security questions or OTP as fallbacks for PIN recovery.
  • Log all failed PIN attempts and implement lockout mechanisms to prevent brute-force attacks.