Authentication Method

The optional authentication_method object can be used for any of the following events:

  • $registration – what method was used to create the user account
  • $login – what method was used to create a new authentication session
  • $challenge – what method was requested from or resolved by the users as additional verification

By sending this information, not only does it provide valuable insight during fraud investigations when used to filter down the dataset as well as configuring policies, but it also helps improve Castle's risk models.

type$authenticator, $biometrics, $email, $password, $phone, $push, $security_key, $social, $ssoSee below for detailed explanation
variantString Optional description of the method variant, e.g. facebook when type is $social, or sms for $phone

Authentication types

Detailed description of the available options for the type parameter

$authenticatorGoogle Authenticator, or any other OTP app
$biometricsApple FaceID/TouchID, Microsoft Hello, etc
$emailEmail confirmation/magic link or PIN code
$kbaKnowledge-based authentication, such as security questions
$passwordStandard password entry, combined with email, phone, or username
$phonePhone confirmation/magic link or PIN code
$pushMobile push notification
$security_keyYubikey, Google Titan, etc
$socialSocial sign-in with Google, Facebook, Apple, etc
$ssoSAML, e.g. Okta or Rippling


 // ...
  "authentication_method": {
    "type": "$phone",
    "variant": "sms"