Orchestration SDKs

Pairing with a QR code or pairing key on Android

PingOne Android

You can pair a device directly, without the device itself having to run a DaVinci flow.

A DaVinci flow still plays a part, but it runs on the accessing device only. That flow creates the pairing key, and your app pairs out-of-band using the key as its input, either as a QR code that the user scans, or as text that the user enters manually.

For example, the accessing device’s sign-on screen displays a QR code for the user to scan with their phone.

To register a device with PingOne MFA manually, call the pingonemfa module’s pair function, providing the pairing key as its only parameter.

The device must be able to reach the PingOne MFA service over the network to pair.

After pairing, the device can generate OATH one-time passcodes in isolation on the device, so they keep working without connectivity.

Push notifications, however, always need connectivity, because the notification has to travel from the PingOne MFA service to the device.

Getting the pairing key

The pairing key comes from your PingOne environment, typically displayed on the accessing device as part of the sign-on flow.

The key can be rendered as a QR code for the user to scan, or shown as text for them to type into your app.

For example, in a DaVinci flow being run on the primary device, you could use the Form connector’s Show Form capability with a form that has a QR Code form field on it, containing the code value from the PingOne MFA connector’s Create Pairing Key capability.

Pairing the device

Ensure that you have initialized the PingOne MFA module before attempting to pair the device.

Then, after obtaining the pairing key, call pair(pairingKey). The function suspends and returns a Result<Unit>.

Pairing with a pairing key
import com.pingidentity.pingonemfa.commons.Geo
import com.pingidentity.pingonemfa.commons.PingOneMFA

// Initialize the module
PingOneMFA.initialize(Geo.NORTH_AMERICA)
    .onSuccess {
        // Obtain the pairing key, for example by decoding a scanned QR code
        // or reading the user-entered text
        val pairingKey = getPairingKey()

        PingOneMFA.pair(pairingKey)
            .onSuccess {
                // Pairing succeeded — update UI as needed
            }
            .onFailure { e ->
                Log.e("MFA", "Pairing failed: ${e.message}")
            }
    }
    .onFailure { e ->
        Log.e("MFA", "Initialization failed: ${e.message}")
    }

After pairing succeeds, the device is registered with the PingOne MFA service. The app can now respond to push notifications and generate one-time passcodes.