Secured sessions with Adyen<\/h2>\n
With secured sessions, your server creates a session with specific permissions and scope. Your client uses this session to communicate directly with Adyen through the SDK.<\/p>\n
Adyen's SDKs for iOS and Android allow you to send a new PIN to Adyen, replacing the previous one. Additionally, they automatically handle all cryptographic operations, such as exchanging keys, encrypting, and decrypting the PIN.<\/p>\n
Secured sessions with Adyen's SDKs offer the following benefits:<\/p>\n
- \n
- Your server never handles sensitive PIN data.<\/li>\n
- Sessions are scoped to a specific card and operation.<\/li>\n
- Sessions are single-use, which prevents replay attacks.<\/li>\n
- End-to-end encryption between the SDK and Adyen protects data in transit.<\/li>\n<\/ul>\n
How it works<\/h2>\n
The following diagram illustrates the PIN change flow using sessions.<\/p>\n
\n
![\"Sequence](\"\/media\/443ce0794cf4ed802da6ddc6a83703d401377003400a20548a7c0dd9bc83e0c8.svg\")
\n<\/a><\/p>\nAs shown in the diagram, the steps to change the PIN are:<\/p>\n
- \n
- Load the application certificate<\/a> when your application starts.<\/li>\n
- Create a session instance<\/a>.<\/li>\n
- Change the PIN<\/a>.<\/li>\n<\/ol>\n
1. Load the application certificate<\/h2>\n
Adyen provides you with an application certificate that you need to initialize Adyen's SDKs. The SDKs use this certificate to establish a secure session with Adyen.<\/p>\n
When your application starts:<\/p>\n
- \n
- \n
Load the application certificate into your application.<\/p>\n
The following tabs show examples of how to load the certificate depending on which SDK you are using.<\/p>\n\n
\n\n2. Create a session instance<\/h2>\n
When a cardholder using your application selects the option to change the PIN, you must initialize the SDK. During initialization, you configure all objects and logic that handle your secure session with Adyen.<\/p>\n
The following tabs show examples of how to initialize Adyen's SDKs for iOS and Android.<\/p>\n\n
\n\n3. Change the PIN<\/h2>\n
After you initialize the SDK, you can create a secured session. Start the flow for a secured session by calling the
CardSession.changePin<\/code> SDK method. This method instructs the backend to make a request to our Session authentication API<\/a>. Then, the SDK method retrieves the session data from the backend and returns it to your application.<\/p>\nTo create a secured session:<\/p>\n
- \n
- \n
From your client application, call the session instance<\/a> that you created. Pass the following parameters:
paymentInstrumentId<\/code>: The payment instrument ID of the card.<\/li>newPin<\/code>: The new PIN for the card.<\/li><\/ul>
\nThis method instructs the backend to make a request for a session. The following tabs show examples for iOS and Android.<\/p>\n\n\n\n- \n
From your backend, make a POST \/sessions<\/a> request with the following parameters:<\/p>\n
- \n
- Create a session instance<\/a>.<\/li>\n
- Load the application certificate<\/a> when your application starts.<\/li>\n