Client-side encryption

When client-side encryption (CSE) is enabled for a verification method, your client can send selected sensitive fields as ciphertext instead of plaintext. cidaas decrypts those fields before completing authentication, enrolment, or password operations.

CSE is available when the tenant has the cse feature and the method’s settings include an encryptionConfig. System methods that support CSE ship with a default config (see below). Admins can turn CSE on or off and set whether encrypted payloads are optional or required via PUT /verification-actions-srv/config (encryptionConfig.enabled, encryptionConfig.mode).

Related: Pluggable Authentication Mechanism · Password Set · Enrollment · Authentication

Configuration

Field	Values	Notes
encryptionConfig.enabled	true / false	When false, plaintext fields are expected.
encryptionConfig.mode	OPTIONAL or REQUIRED	OPTIONAL accepts plaintext or ciphertext for listed fields. REQUIRED expects encrypted values for those fields.
encryptionConfig.encryptedFields	string array	Field names that may (or must) be sent encrypted for that method.

System defaults (seeded when CSE is available):

Method	Encrypted fields
PASSWORD	password, new_password, confirm_password, confirmPassword, password_echo, old_password
BACKUPCODE	pass_code
PATTERN	pass_code

Only methods that already have an encryptionConfig accept updates to enabled / mode. Custom (pluggable) methods without CSE config cannot enable encryption through this path.

Where decryption runs

When CSE is enabled for the method, cidaas decrypts listed fields on:

Flow	Endpoint (family)
Authenticate / perform	…/verification-srv/authentication/{method}/verification
Finish enrolment	…/verification-actions-srv/setup/{method}/verification
Set password	POST /password-srv/password
Change password	PUT /password-srv/password
Accept password reset	POST /password-srv/resetpassword with action accept (or acceptreset)

Password-reset initiate / validate code steps do not decrypt CSE payloads — only the accept step does.

Integrator checklist

1. Confirm the tenant has CSE and the method’s encryptionConfig.enabled is true (list methods via GET /verification-actions-srv/config).
2. Check mode: under OPTIONAL you may still send plaintext for development; under REQUIRED encrypt every listed field.
3. Encrypt only the fields named in encryptedFields for that method; leave other JSON/form fields unchanged.
4. Use the same client crypto contract your cidaas mobile / hosted SDK documents for your tenant (key material and ciphertext format are tenant/SDK-specific).

OpenAPI

encryptionConfig on verification method settings is not yet fully exposed in the public OpenAPI for /verification-actions-srv/config. Use this guide and the config API responses as the source of truth until the OpenAPI paths are published.

info

Need Support?

For assistance, visit our Support Portal.