Skip to main content
Version: current
Version: 1.0

Vouch Auth Client API

This API implements the Secure Biometric Authentication (SBA) protocol for Vouch. It provides endpoints for device provisioning, attestation, and payload assertion.

Host Implementation​

The API requires a host implementation that represents a secure device (typically a smartphone, tablet, smartwatch, or any other device capable of secure key storage) that wishes to communicate with the Vouch backend. The host must provide the following capabilities:

Storage Operations​

  • storage-get: Retrieve stored data
  • storage-put!: Store new data
  • storage-remove!: Remove stored data

Keyring Operations​

  • keyring-public-key: Retrieve public keys
  • keyring-create!: Create new key pairs
  • keyring-remove!: Remove existing keys
  • keyring-sign: Sign data with private keys

Nonce Management​

  • next-nonce!: Generate and track the next nonce
  • clear-nonce!: Reset nonce state

Security Considerations​

The host implementation must ensure:

  1. Secure storage of private keys
  2. Protection against key extraction
  3. Proper nonce management to prevent replay attacks
  4. Secure execution environment for cryptographic operations

Typical Use Cases​

  1. Device Provisioning: Initial setup of a new device with Vouch

  2. Device Attestation: Proving device identity to the backend

  3. Payload Assertion: Creating authenticated requests

  4. Device Reset: Removing all device data