App User ID is the unique identifier for a user in a TrustFactor application. It is recommended not to re-use your internal user id, so application users cannot be mapped from TrustFactor to your app without your internal mapping table.
Keep track of the correlation id for each request, so it will be easier to debug when needed. It is highly recommended sending the correlation id for support purposes linked to the requests and the date.
Every request timeout can be adjusted. The HTTP Client timeout cannot exceed 30 seconds due to infrastructure restrictions.
In requests like Reset Contract Device where the application will receive a callback, it should be possible in 30 seconds for the application to send the request, TrustFactor services process it and the application respond to the callback so the application should respond to it in less than 30 seconds as defined in the backoffice.
Avoid keeping track of contract keys since they are prone to desynchronize between Application/TrustFactor services.
Custom headers on transaction creation can help keeping track of the decision process as the transaction callback brings all the custom headers. There are some blocked headers which are listed at the Attachment #2 in the Attachments chapter.
Update to the latest version of each API as soon as possible. New features may only be available on newer API versions so it is highly recommended to keep the SDKs and methods up-to-date.
When the user completes the registration flow, a screen with the registered device details should be presented to the user, so they can confirm that it was their device that registered. As the QR Code is presented in a screen anyone can read the same QR Code and register in the users account, so this serves as an additional validation by the user that the correct device was enrolled. The user should be given the opportunity to remove the recently registered device, but only for a short period of time, in case an attacker succeeds to register theirs instead of the legitimate user’s device.
The application should implement user notifications (like email / SMS message) when they receive the following callbacks, to inform users that changes have occurred with their TrustFactor enrollment for your app, for a given app user ID:
Share Contract
Contract Recover
Remove Device Contract
Make Info/Debug logs of all requests/responses and callbacks from TrustFactor.