> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/esign-v2-online-aadhaar-ekyc/authentication-modes.md).

# Authentication Modes

eSign v2 authenticates the signer against UIDAI. The ASP chooses the mode through the `AuthMode` attribute of the request. Regardless of mode, **the ASP never handles the Aadhaar number, OTP or biometric** — these are captured on eMudhra's pages or by UIDAI-certified device software and sent encrypted to UIDAI.

| AuthMode | Factor      | Class         | Capture                                                   |
| -------- | ----------- | ------------- | --------------------------------------------------------- |
| `1`      | OTP / TOTP  | Single factor | OTP to Aadhaar-linked mobile, entered on the eMudhra page |
| `2`      | Fingerprint | Multi factor  | L1 RD fingerprint scanner via RD Service                  |
| `3`      | Iris        | Multi factor  | RD iris scanner via RD Service                            |
| `4`      | Face        | —             | UIDAI face-capture app (Android and iOS)                  |

{% hint style="info" %}
Availability of each mode by platform (Web, Android / iOS intent, App-to-App, SDK) is listed in the support matrix on the **Integration Models** page. In summary: fingerprint and iris are not available on iOS (no vendor RD Service), OTP / T-OTP do not use an app intent, and Face Auth is not used in desktop web flows.
{% endhint %}

## 1. Aadhaar OTP / T-OTP (AuthMode 1)

The most widely used mode — no hardware required.

1. User lands on the eMudhra eSign page and sees the document information and consent text.
2. User enters their Aadhaar number (or Virtual ID) and gives consent.
3. eMudhra requests an OTP from UIDAI; it is delivered to the Aadhaar-linked mobile.
4. User enters the OTP; eMudhra completes eKYC and proceeds to signing.

**Requirements:** a mobile number linked to Aadhaar. **Typical errors:** `ESP-944` (user cancelled), `ESP-945` (cancelled after OTP generation), `ESP-946` (page expired), UIDAI OTP errors forwarded as-is.

## 2. Aadhaar Fingerprint (AuthMode 2)

Used in assisted and high-assurance flows.

1. The eMudhra page detects the RD Service on the device (Windows/Linux desktop or Android). iOS is not supported because device vendors do not provide an iOS RD Service.
2. The signer places a finger on the scanner; the **RD Service** captures, encrypts and signs the biometric (PID block) with the device key.
3. eMudhra forwards the encrypted PID to UIDAI for authentication and eKYC.

**Requirements**

* UIDAI-certified **L1 Registered Device** (L0 devices are being phased out by UIDAI) and its RD Service installed and in "READY" state.
* Browser-based capture uses the RD Service local HTTP interface; Android uses the RD Service intent.
* For assisted flows, the operator device must belong to the ASP and be managed under its device policy.

## 3. Aadhaar Iris (AuthMode 3)

Identical flow to fingerprint, using a certified iris scanner and its RD Service. Recommended where fingerprint quality is poor (manual labour, elderly residents).

## 4. Aadhaar Face (AuthMode 4)

Added in eSign API 2.1 (07.02.2023). Uses UIDAI's face authentication with liveness detection — no external device needed.

1. The flow requests face capture from the **AadhaarFaceRD** app (UIDAI) on the signer's Android or iOS device.
2. The app performs liveness checks and returns an encrypted PID block.
3. eMudhra sends it to UIDAI for authentication and eKYC.

**Requirements**

* Android or iOS device with the UIDAI face-capture app installed (eMudhra's SDK prompts the user to install it if missing).
* Front camera and good lighting. Face capture is invoked through an app intent, so face mode is available in **App-to-App**, **Embedded SDK** and **Web-to-App** (Android and iOS) models, but not in desktop web flows.

{% hint style="info" %}
CCA API 2.1 maps OTP to Single Factor and fingerprint/iris to Multi Factor but does not state a class for face. eMudhra records the AuthMode used on Form C for every transaction.
{% endhint %}

## Choosing a mode

| Scenario                                      | Recommended mode                                    |
| --------------------------------------------- | --------------------------------------------------- |
| Self-service mobile journeys (Android or iOS) | OTP / T-OTP (1) or Face (4)                         |
| Branch / agent / BC assisted onboarding       | Fingerprint (2) or Face (4)                         |
| Users without Aadhaar-linked mobile           | Fingerprint (2), Iris (3) or Face (4) — or eSign v3 |
| Highest assurance for regulated transactions  | Fingerprint (2) or Iris (3)                         |