Authentication methods

The same policy works for people who carry a phone, people who share a terminal on the shop floor, and the supplier who signs in once a month. Each method verifies the user in a different way, and almost all of them can be combined with the location signature.

Method	Who it is for	How it verifies	Location
Mobile app	Staff with a personal or company phone	Phone notification, fingerprint or face, and the place signature, in one tap	With location signature
Desktop app	Offices where phones are not allowed	A key stored on the computer itself plus a temporary code	With location signature
Passkeys and FIDO2	Web services and computers with a physical key	Cryptographic credential that never travels to the server, with the device biometrics	With location signature
Facial recognition	Workstations where nothing should be touched	The camera of the computer or phone, bound to that specific device	With location signature
USB token	Clean rooms, shop floor and environments without biometrics	The key is split between the token and the computer: both are required	With location signature
NFC / RFID card	Shifts and shared terminals	The same badge used to clock in, held against a reader	With location signature
Magic link / SMS	Collaborators who sign in occasionally	A link or code that expires after one use	Location optional
Agentless	Servers and computers that do not allow installs	The source network and the credential they already used, evaluated on the server	With location signature

Each method links to its usage guide. The rest of the guides are in the user guide.

Configurable authentication factors

Factor	Description
Location	The user’s safe zone as a contextual, continuous and silent identity factor.
Push Notification	Notification on the user’s phone or desktop to approve or reject access.
Software OTP	One-time code generated by the Ironchip mobile or desktop app.
Hardware OTP / USB Token	Physical token for environments that require a tangible second factor.
NFC/RFID card	With a reader built into the keyboard or an NFC reader connected over USB, any NFC/RFID card or element can be integrated.
Email / SMS	Additional methods as a secondary factor, configurable per profile.
Password (optional)	It can be kept or removed completely in passwordless models.

Mobile app (iOS and Android)

The mobile app is the most common authentication method. It is available for iOS and Android, and you can download it from the App Store and Google Play. It acts as a second factor through a push notification and electromagnetic location verification.

Enrollment

1. The administrator creates the user in the admin console.
2. The user receives an email with the Verify my account button.
3. The user clicks Continue and downloads the app if they do not have it yet.
4. The user accepts the permissions the app asks for.
5. Optionally, the user turns on biometrics (fingerprint or facial recognition).
6. The user scans the QR code shown on screen with the Ironchip app. Enrollment is complete.

Regular authentication

1. The user enters their credentials in the service they want to access.
2. A push notification arrives on the phone through the Ironchip app.
3. Tapping the notification opens the app. If biometrics are set up, they are validated.
4. When the user taps Authorize, the app scans the electromagnetic signals of the environment and checks whether the user is in the authorized safe zone.
5. If the verification succeeds, access to the service is granted.

Alternative authentication, from the app

1. The user enters their credentials in the service.
2. Instead of tapping the push notification, the user opens the Ironchip app directly.
3. On the Services tab, a countdown appears on the service the user tried to access.
4. The user taps the service card before the time runs out.
5. The user taps Authorize: the system scans the signals and verifies the location. Access is granted if the user is in an authorized zone.

Safe zones in the mobile app

Safe zones are managed on the keys tab. To create a new one, tap +, type a name and tap Add Safe Zone. The progress wheel shows that the electromagnetic signature is being captured.

Usage guide: Mobile app.

Desktop app (Windows, Linux and macOS)

The desktop app lets users authenticate without a phone. It works on Windows, Linux and macOS and acts as a second factor through a local notification on the computer itself.

Enrollment

1. The administrator creates the user in the admin console.
2. The user receives the email and clicks Verify my account.
3. With the desktop app already installed, the user clicks Continue.
4. The user copies the security code shown on screen and enters it in the Ironchip desktop app. Enrollment is complete.

Variant: identity on an external device (data USB)

You can carry the identity credentials on an external storage device (USB). This way the user can authenticate on any computer that has the Ironchip desktop services installed.

1. During enrollment, the user plugs in the external storage device.
2. The user clicks the refresh button so the device is detected.
3. The user selects the device in the drop-down list.

The external device must stay connected to use the desktop app.

Authentication

1. The user enters their credentials in the service.
2. The desktop app shows a local notification.
3. Clicking the notification opens the Ironchip app on the desktop.
4. When the user clicks Authorize, the system verifies the location and the device. Access is granted if the conditions are met.

Usage guide: Desktop app.

RFID / NFC (cards and readers)

The RFID method authenticates users with RFID/NFC cards or tags and a reader connected to the computer. It is ideal for industrial, hospital and hotel environments, or any workstation with high turnover where the user cannot or should not use a phone.

Configuration steps

1. Download the RFID Authenticator agent from the Plugins section of the admin console.

2. Generate an API key: go to Authentication Policies > Device Policies > Add device policy and turn on Use RFID protocol. The system generates the API key automatically.

3. Create each user’s access: in the service you created, click Add access, select the authenticator user and enter the user to protect (format DOMAIN\user or COMPUTER\user).

4. Register the RFID cards: go to Directory > Devices > RFID > Synchronize. Download the CSV template, fill in the fields and upload it. Select the RFID policy and confirm.

5. Configure the agent: open PowerShell as administrator in the directory of the downloaded agent and run:

   .\IronchipRFID.exe c --api_key <API_KEY>

CSV template fields

UserID (the user’s ID in Ironchip), Email (the user’s email), Name (a name that identifies the card) and UUID (the unique identifier of the RFID chip).

RFID authentication flow

1. The employee holds their RFID or NFC card against the reader connected to the computer.
2. The reader captures the unique UUID of the chip.
3. The Ironchip agent validates the UUID against the paired user and checks the access conditions (zone, schedule, policy).
4. If the validation succeeds, access is granted without a password, PIN or phone.

Full guide: NFC / RFID card.

Offline authentication (offline OTP)

The Offline method lets users authenticate without an internet connection with a locally generated OTP code. It is especially useful in industrial environments, areas without coverage or air-gapped networks.

• The mobile or desktop app generates a one-time OTP code without needing a connection.
• In Windows logon, the OTP service is installed as an additional component during the plugin installation.
• The OTP code has a limited validity period and is unique per device.
• It does not require authorization from the Ironchip server at the time of access.

Note

Offline authentication requires the device to have been paired with the platform beforehand in an environment with a connection. The OTP code is generated from the shared secret that is stored locally on the paired device.

More information: Authenticate with Ironchip.

Can I authenticate to services offline?

Yes. Ironchip offers the Offline feature, which lets you access the device without authorization from the phone. The feature uses an offline code to verify your identity and allow access to services even when you have no internet connection.

Magic link (link by email)

A magic link is a secure, single-use link sent by email. It lets users authenticate without installing any agent or registering any device. It is ideal for external suppliers, occasional users or one-off access.

1. The user tries to access the service.
2. Ironchip automatically sends the user an email with an authentication link.
3. The user clicks the link and access is granted without an additional password.
4. The link expires after a single use or after the time the administrator has configured.

• It does not require installing any agent or app on the user’s device.
• The administrator can configure the duration and scope of the access.
• It works with any device that can access email.

Biometrics (fingerprint and facial recognition)

Does the authentication app use biometrics?

Yes. The Ironchip authentication app can use biometrics as an additional security factor. Users can set them up in the app and authenticate with unique physical or behavioral characteristics, such as fingerprints or facial recognition.

Biometrics act as an unlock layer for the mobile app, not as an independent authentication factor. The user sets them up during enrollment so they do not have to enter a PIN every time they approve an authentication.

• Available methods: fingerprint and facial recognition, depending on the mobile device.
• Biometrics are optional and set up during enrollment in the mobile app.
• Ironchip does not store any biometric data on its servers: validation happens only on the user’s device.
• It complies with GDPR, because no biometric data is transmitted or stored centrally.

Comparison of methods

Method	Device	No phone	Offline	No installation	Main use case
Mobile app	iOS / Android	✗	✗	✗	Standard user with a company phone
Desktop app	Windows / Linux / macOS	✓	✗	✗	User without a company phone
Windows logon	Windows	✓	✓ (OTP)	✗	Protect the Windows operating system sign-in
Linux PAM	Linux	✓	✗	✗	Servers, bastion hosts and SSH
macOS PAM	macOS	✓	✗	✗	Corporate Apple computers
RFID / NFC	Any PC	✓	✓	✗	Shared workstations, hospital and industrial settings
Offline OTP	Mobile / desktop	✓	✓	✗	Areas without coverage, isolated networks
Magic link	Any device	✓	✗	✓	External suppliers, occasional users
Biometrics	Mobile	✗	✗	✗	Security add-on in the mobile app

Frequently asked questions

Do I need a mobile device to authenticate with Ironchip?

No. Besides the push notification on the phone, there is a desktop app that works on Windows, Linux and macOS. The platform also offers other methods, such as the Offline feature and the USB feature. With them you can access the device without authorization from the phone, using an offline code or a USB.