Use Your Own Authentication

It is likely that after moving through pilot or beyond pilot phase an Issuing Entity will be interested to control their own binding instead of using the existing OAuth scenario provided by default by SimplyTapp.  This page covers some of the documentation on how to control the authentication binding entirely by yourself, but still use the SimplyTapp platform.

You will need to contact SimplyTapp to receive the proper credentials to allow your servers to communicate to SimplyTapp to approve all authentication binding behind the scenes, but once you have that in place, it is possible to use the AdminApi set to control all aspects of creating and managing:
+Wallet mobile apps used by users
+Cards contained in wallet mobile apps

It is important to know that using the AdminApi set gives complete control to the issuing entity and forces that entity to control and manage the binding mechanism between mobile device and cloud services.

Below is one way to manage this use case as an issuing entity.

The bank needs to add these services for the mobile device!!


This API will receive 2 values that will allow the ST mobile libraries to :

Get a list of cards contained in under this particular key and secret pair
Load and boot a card agent
Disable or enable the display of a remote card


This API will add a new card to the application.  It will receive a success or fail and will effect the number of virtual cards created inside the users card list

Proposed logic to manage binding

The mapping table should be maintained by BANK.  BANK can generate any new App Token and App Secret by using AdminApi:

From the AdminApi document.

When GetAppAccessTokenAndSecret is called through mobilizer by the mobile app, the BANK system and see if there is an App Token and Secret from the database, and if not, call the AdminApi CreateAppToken and then relay that app token and secret to the mobile app.  The mobile app can then use the token and secret to continue to access ST api’s to the card server

At any time, BANK can generate a new token and secret from the CreateAppToken API to destroy the viability of the previous token

Proposed logic to manage cards

The card mapping table should be maintained by BANK.  BANK can generate any new Card Token and Card Secret by using AdminApi:


From the AdminApi document.

When AddHCECard is called through mobilizer by the mobile app, the BANK system and call the AdminApi CreateCardToken and store the card token and secret for use to connect and manage that card through STBridge tools. 

Adding a card will add to the card list of the mobile application card list request through simplytapp mobile libraries

Proposed flow to add HCE card