> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/esign-v3-ca-ekyc-account/signer-authentication.md).

# Signer Authentication

eSign v3 uses two-factor authentication to the signer's eKYC account: a **PIN** (first factor) plus one **second factor**.

## Second factors

| Factor               | `authenticationType` | Rules                                                                                |
| -------------------- | -------------------- | ------------------------------------------------------------------------------------ |
| SMS-OTP (default)    | `SMSOTP`             | Valid up to 15 minutes; one trigger per minute; max 5 failed attempts                |
| Time-based OTP       | `TOTP`               | RFC 6238; 30 or 60 s step; ±1 step drift                                             |
| Mobile Access Token  | `MAT`                | Device-bound token in the eMudhra app; one per user; expires 3 months after last use |
| FIDO2                | `FIDO`               | Key pair in device TPM / secure enclave; credential valid ≤ 1 year                   |
| Public-key signature | `PUBSIGN`            | RSA-2048+ or ECC P-256+; key valid ≤ 3 years                                         |

## Modes

* **Composite** — PIN and second factor submitted together.
* **Independent** — PIN and second factor submitted in separate steps linked by `txn` and signer ID; the first step returns status `2` (pending second factor).

## PIN protection

The PIN is never sent in clear. The eKYC request carries `pinhash = hash(txn + hash(pin))`, binding the PIN proof to the transaction and preventing replay.

## Where authentication happens

| Channel            | Experience                                                                                                      |
| ------------------ | --------------------------------------------------------------------------------------------------------------- |
| Browser redirect   | ASP redirects to eMudhra page using `redirectUrl`; user enters username, PIN and OTP.                           |
| eMudhra mobile app | User receives a push/in-app request, reviews documents (with `docUrl` links) and approves with PIN + MAT/FIDO2. |
| Embedded SDK       | eMudhra SDK presents the same flow inside the ASP app.                                                          |

## Consent

Verified OTP or Mobile Access Token, together with the purpose text shown to the user, is treated as consent for certificate issuance and signing, per CCA guidelines.