Skip to main content
The NFC Chip Authentication module validates the authenticity of identity documents that contain an embedded NFC (Near Field Communication) chip. This page contains documentation for the NFC Chip Authentication module, including its capabilities and the specific result values it returns.

​
NFC Chip Authentication

The NFC Chip Authentication module performs different cryptographic checks against the document’s embedded chip, each targeting a different threat vector. The overall authentication result aggregates these individual checks. If any single check fails, the overall result fails.

​
Capabilities

The module returns the NFC Chip Authentication capability.

​
NFC Chip Authentication

This capability provides the aggregate outcome of all NFC chip authentication checks. It fails if any of the three individual authentication checks (passive, active, or chip) fails. This is the primary capability used in evaluation and routing logic.
ValueDescription
PASSEDAll individual authentication checks passed. The chip is genuine, the data is authentic and unmodified, and the chip has not been cloned.
FAILEDOne or more individual authentication checks failed. The document’s NFC chip could not be fully validated.
ERRORThe overall authentication could not be completed due to a technical issue.

​
Input payload

The following is a sample payload used to submit NFC chip data to the NFC Chip Authentication module for processing.
JSON
{
  "resourceId": "<resourceId>",
  "context": {
    "subject": {
      "documents": [
        {
          "mrz": "<string>",
          "chip": {
            "lds": [
              {
                "name": "<string>",
                "data": "<base64-encoded string>"
              }
            ],
            "auth": [
              {
                "type": "<string>",
                "result": "<string>"
              }
            ]
          }
        }
      ]
    }
  }
}
FieldRequiredDescription
mrzYesThe machine-readable zone string extracted from the document. Used to establish a secure communication channel with the chip.
chip.ldsYesAn array of Logical Data Structure (LDS) entries read from the chip. Each entry contains a name identifying the data group and a base64-encoded data payload.
chip.authYesAn array of authentication check results performed during the chip reading process. Each entry contains a type identifying the check and a result indicating its outcome.