--- title: Configuring Advanced Identity Cloud for PingOne Recognize description: "Configures the server-side prerequisites for integrating PingOne Recognize with journeys: configuring the Recognize services, and creating an authentication journey that uses the Recognize nodes." component: orchsdks page_id: orchsdks:journey:use-cases/recognize/before-you-begin canonical_url: https://developer.pingidentity.com/orchsdks/journey/use-cases/recognize/before-you-begin.html llms_txt: https://developer.pingidentity.com/orchsdks/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: Wed, 09 Sep 2026 14:00:00 +0000 keywords: ["PingOne Recognize", "Biometric", "Journey", "Prerequisites", "Server Configuration", "Recognize nodes"] section_ids: configure-service: Step 1. Configure the Recognize services configure-recognize-service: Configure the PingOne Recognize service configure-recognize-device-service: Configure the PingOne Recognize device service create-journeys: Step 2. Create journeys for Recognize next_steps: Next steps --- # Configuring Advanced Identity Cloud for PingOne Recognize [icon: circle-check, set=far]PingOne Advanced Identity Cloud [icon: android, set=fab]Android Before you configure your client application to use PingOne Recognize, you must complete two steps in your PingOne Advanced Identity Cloud tenant: * [Configure the PingOne Recognize services](#configure-service) Configure the **PingOne Recognize service**, which holds the details of your Recognize installation, and the **PingOne Recognize device service**, which stores each user's Recognize profile. [**Complete this step**[icon: chevrons-right, set=fas, size=xs]](#configure-service) * [Create an authentication journey](#create-journeys) Create a journey that includes the following PingOne Recognize nodes: * [PingOne Recognize Enrollment node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-enrollment.html) * [PingOne Recognize Authentication node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-authentication.html) [**Complete this step**[icon: chevrons-right, set=fas, size=xs]](#create-journeys) ## Step 1. Configure the Recognize services Journeys that use PingOne Recognize require two services in your realm: ### Configure the PingOne Recognize service The PingOne Recognize service stores the details PingOne Advanced Identity Cloud needs to connect to your PingOne Recognize installation. The Recognize nodes read this configuration and pass it to your app in the `PingOneRecognizeCallback` output fields, such as the Recognize host, API key, and customer name. To configure the service: 1. In your PingOne Advanced Identity Cloud tenant, navigate to Native Consoles > Access Management. 2. In the left panel, select the realm, then go to Services > [icon: plus, set=fa]Add a Service. 3. Select PingOne Recognize service from the list of service types, then click Create, and enable the service. 4. On the Secondary Configurations tab, configure the settings for your Recognize installation. * General * Settings that apply to the PingOne Advanced Identity Cloud connection to the Recognize server API. **General configuration properties** | Property | Description | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Server API Key Secret Label Identifier | An identifier that PingOne Advanced Identity Cloud uses to build the secret label holding the API key that authenticates to the Recognize server API, for example `am.services.pingone.recognize.identifier.serverapikey`. | | Server API URL | The URL of the Recognize server API endpoint. | * Web SDK * Settings used by web-based client integrations. **Web SDK configuration properties** | Property | Description | | -------------------------- | ---------------------------------------------------------------------------------------------- | | Authentication Service URL | The authentication service URL of the Recognize server, used by web-based client integrations. | | Customer Name | The customer name registered on the Recognize server. | * Mobile SDK * Settings used by mobile app client integrations. **Mobile SDK configuration properties** | Property | Description | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Host | The hostname of the Recognize server, used by mobile app client integrations. | | Recognize API Key Secret Label Identifier | An identifier that PingOne Advanced Identity Cloud uses to build the secret label holding the API key that mobile app client integrations use to connect to the Recognize server, for example `am.services.pingone.recognize.identifier.recognizeapikey`. | ### Configure the PingOne Recognize device service The PingOne Recognize device service stores each user's Recognize profile in the identity store, including their enrolled device profiles and account state. The nodes read and write these profiles during enrollment and authentication. To configure the device service: 1. In your PingOne Advanced Identity Cloud tenant, navigate to Native Consoles > Access Management. 2. In the left panel, select the realm, then go to Services > [icon: plus, set=fa]Add a Service. 3. Select PingOne Recognize device service from the list of service types, then click Create. 4. Configure the settings for the device service: **User profile attributes** | Property | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | PingOne Recognize Device Attribute | The user attribute in which to store enrolled device profiles.The default is `pingOneRecognizeDeviceProfiles`. | | PingOne Recognize User Profile Attribute | The user attribute in which to store per-user account state. The default is `pingOneRecognizeUserProfile`. | The default attributes are added to the user store schema when you prepare the user store. If you configure a different attribute, add it to your user store schema first, and make sure PingOne Advanced Identity Cloud can write to it. **Device profile encryption properties** | Property | Description | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | Device Profile Encryption Scheme | The scheme used to encrypt each device profile and the per-user account state. | | Encryption Key Store | Path to the keystore from which to load encryption keys. | | Key Store Type | The type of the keystore. | | Key Store Password | Password to unlock the keystore. PingOne Advanced Identity Cloud encrypts this password when you save it in the configuration. | | Key-Pair Alias | Alias of the certificate and private key in the keystore. The private key encrypts and decrypts device profiles and per-user account state. | | Private Key Password | Password to unlock the private key. | | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | For greater security, store the encryption key information in a secret store instead of in the configuration, using the `am.services.pingonerecognizedevice.encryption` secret label to map an alias for the device service secrets. | ## Step 2. Create journeys for Recognize The server provides two nodes to integrate PingOne Recognize into your journeys: * [PingOne Recognize Enrollment node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-enrollment.html) Enrolls a user's biometric data with PingOne Recognize. * [PingOne Recognize Authentication node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-authentication.html) Authenticates a user with PingOne Recognize using biometric facial recognition. Create a journey using these nodes to integrate PingOne Recognize into your authentication flow. For example, the following passwordless journey authenticates a user with PingOne Recognize. If they have not previously enrolled, the journey collects their password and verifies their identity before letting them enroll their biometric data: ![pingone recognize example journey](../../../_images/use-cases/pingone-recognize-example-journey.png)Figure 1. Example journey that authenticates and enrolls a user with PingOne Recognize * [Platform Username node](https://docs.pingidentity.com/auth-node-ref/latest/platform-username.html) prompts the user for their username. * [Identify Existing User node](https://docs.pingidentity.com/auth-node-ref/latest/identify-existing-user.html) checks that the user exists in the identity store. * [PingOne Recognize Authentication node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-authentication.html) sends a `PingOneRecognizeCallback` to your app to trigger the authentication flow on the client device. The journey continues on the following outcomes: * Success: authentication succeeded, so the journey completes. * Not Enrolled: the user is not enrolled with PingOne Recognize, so the journey collects their password and verifies them before enrollment. * Client Error: PingOne Recognize returned an error; the error message and code are written to shared state. * Failure: authentication failed for a reason other than a client error, for example a session timeout or camera permission denied. * [Platform Password node](https://docs.pingidentity.com/auth-node-ref/latest/platform-password.html) prompts the user for their password. * [Data Store Decision node](https://docs.pingidentity.com/auth-node-ref/latest/data-store-decision.html) validates the username-password credentials. * [PingOne Recognize Enrollment node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-enrollment.html) sends a `PingOneRecognizeCallback` to your app to trigger the enrollment flow on the client device. The journey continues on the following outcomes: * Success: enrollment succeeded, so the journey completes. * Client Error: PingOne Recognize returned an error; the error message and code are written to shared state. * Failure: enrollment failed for a reason other than a client error, for example a session timeout or camera permission denied. Configure the node properties to match your client integration: * PingOne Recognize Service: select the name of the PingOne Recognize service configuration you created in [Step 1. Configure the Recognize services](#configure-service). * Generate Client State: when enabled, PingOne Recognize generates client state on success, which the journey can use later, for example to enroll a second device. * Liveness Configuration: the liveness detection level the app applies during the ceremony, from minimal checks for development to enhanced checks for high-security operations. * Camera Delay: how long, in seconds, the app waits before capturing an image. Optionally, configure additional settings, such as custom Client Error Outcomes, and extra options to pass to the Recognize SDKs. Learn more in the [PingOne Recognize Enrollment node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-enrollment.html) and [PingOne Recognize Authentication node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-recognize-authentication.html) documentation. ## Next steps Select your platform to configure your client application to enroll and authenticate users with PingOne Recognize: [icon: android, set=fab, size=3x] #### [Android](android/index.html) Integrate Android apps with PingOne Recognize