Skip to main content
The Hanko Authenticator adds strong multi-factor authentication (MFA) to your application: white-label push authentication and passwordless mobile login, similar to Microsoft Authenticator or DUO Security, that you can self-host or run in the EU. It’s a common choice for teams that need a self-hosted or EU-hosted MFA solution — for example when migrating an identity stack from Entra ID or Okta to a self-hosted Keycloak, where the Hanko Keycloak plugin adds the Hanko Authenticator as a login option. You can add it to your application in one of two ways:
  • a white-label Hanko Authenticator mobile app that confirms sign-ins out-of-band, via QR code or push notification, or
  • the Hanko FIDO UAF Client SDK, which embeds the same biometric/PIN confirmation directly into your own native Android or iOS app.
Both approaches talk to the same Hanko API and are built on Hanko’s certified FIDO UAF server — the open authentication standard behind the cryptography, covered in more detail on the FIDO UAF background page.
The Hanko Authenticator API isn’t provisioned through the Hanko Cloud Console yet, and we don’t currently run it as a production service — only a test instance is available. Contact us for test access. Most customers running the Hanko Authenticator today self-host the API.

​
Use cases

​
Push authentication with the Hanko Authenticator app

The Hanko Authenticator app gives your users a customizable, white-label second factor: after starting a sign-in or a sensitive transaction, they confirm it with a biometric gesture or PIN on their phone — no OTP codes to type, no SMS to wait for. Confirmation happens “out-of-band” — over a channel separate from the one used to sign in: a user starts the process on their desktop and confirms it on their phone in response to a QR code or push notification.
Hanko Authenticator out-of-band use case
Because confirmation happens on the phone, users don’t need a desktop with built-in biometrics or a hardware security key — any desktop with a browser works. Get started with the Hanko Authenticator app

​
On-device MFA with the FIDO UAF Client SDK

If you’d rather build second-factor or passwordless authentication directly into your own native mobile app instead of directing users to a separate authenticator app, use the Hanko FIDO UAF Client SDK for Android and iOS. Unlike the Hanko Authenticator app, everything happens on-device: all communication originates from your app and runs through your backend to the Hanko API — there’s no separate out-of-band channel involved.
Hanko FIDO UAF Client on-device use case
Get started with the Hanko FIDO UAF Client for Android or iOS

​
Next steps

Core components

Understand the pieces that make up the Hanko Authenticator service.

Quickstart: Hanko Authenticator app

Register and authenticate devices with the out-of-band mobile app.

Quickstart: FIDO UAF Client SDK

Add on-device FIDO UAF authentication to your native Android or iOS app.

What is FIDO UAF?

Optional background reading on the FIDO UAF protocol behind the Hanko Authenticator.