Generic selectors
Exact matches only
Search in title
Search in content


Two-Factor Authentication with SecSign ID

Use SecSign ID C-API two factor authentication on your C-API project with an easy and highly secure user login using iOS or Android mobile devices as well as for desktop use.

Find out why our Two-Factor Authentication is the best, some key-facts for developers and why you should upgrade to SecSign for your business.

Learn more about the options of on-premise use and your own customized ID App in your corporate design.

Download the plugin as cloud version for a free and convenient protection.

Table of contents

    SecSign ID two factor authentication adds another layer of security to your website by using a second token. In this case the physical token is your smartphone.

    You can find a fully functional example for the two-factor authentication integration in the C API archive, together with the API ‘libsecsignid.c’ and the corresponding header file. All source codes are available on our SecSign GitHub page.

    Questions? Feel free to get in touch with us if you need help setting up your SecSign ID plugin or to request a plugin for a not yet supported environment.

    1. Setup the example


    To compile the program and ensure smooth implementation, the following requirements must be met:

    1. Unix Platform or Mac
    2. gcc compiler
    3. libcurl installed
    4. Internet connection (the SecSignID server communicates via Port 443)

    Download the SecSign C sample archive and unzip it. The library contains four files:

    1. Makefile: Is used to compile the source file.
    2. ibsecsinid.c: C library for the SecSign ID Two-Factor Authentication
    3. libsecsinid.h: Corresponding header-file with type definitions and function prototypes.
    4. secsignid_example.c: Sample program for using the SecSign ID.

    The gcc compiler and libcurl can for example be installed via Debian:

    apt-get update
    apt-get install build-essential
    apt-get install curl

    The easiest way to install compiler gcc and libcurl on a Mac is via Homebrew.

    To compile the source program open a Shell or the terminal, switch to the unpacked directory containing the C-Script and enter make. The program secsignid_example is created and can be implemented via


    2. Integration of the API

    Download the SecSign ID C API and add it to you C project.

    #include "libsecsignid.h"

    All library functions can now be used and the Two-Factor Authentication can easily be integrated. For compiling the SecSign ID library and the flag-lcurl need to be specified:

     gcc -o prog_with_secsignid prog_with_secsignid_source.c libsecsignid.c -lcurl 

    3. Debugging & Logging

    The library has a debug modus which displays any interface communication. This way it can be verified that all requests are sent correctly and the session status is requested. To activate the debug modus, integrate the SecSign ID and call the setDebug with the following parameter:

    1. NO = no debugging (Standard)
    2. YES = Output on StdOut
    3. FILEDEBUG = Output in file

    The second parameter is the path to the debug file.

    #define DEBUGFILEPATH  "secsignid.debug"
    setbuf(stdout, NULL);

    Logging is meant for interface errors. Both technical (for example wrong parameter syntax) and API errors (for example user not found) are logged. By using setLog one can decide to log all errors in the syslog or a separate file. The second parameter determines the file name:

    1. FILELOG = Errors are logged in a file, the second parameter is the file name of the log file.
    2. SYSLOG = Errors are logged in the syslog, the second parameter is ignored but needs to be available.
    3. NO = No logging, the second parameter is ignored but needs to be available.

    #define LOGFILEPATH  "secsignid.log"

    4. Request a session

    Request a new authentication session from the SecSign ID Server. To request a session, the name or SecSign ID, respectively, and the name of the C-project have to be sent to the server. The name of the program is displayed to the user on the smartphone. The authentication session consists of a session ID, the SecSign ID and an AccessPass.

    The AccessPass contains a base64 coded PNG-image, which has to be displayed to the user. The same image is displayed on the smartphone and by comparing both the session is accepted on the device.

    If displaying an image is not an option (for example with a two-step Two-Factor Authentication of a SSH connection) the AccessPass can be omitted. The user then gets a request on his phone which can be denied or accepted. No AccessPass is presented. This option should only be used for two step authentication processes.

    char *secsignid = "johndoe";
    char *serviceName = "libsecsignidCtest";
    char *serviceAddress = "localhost";
    int showAccessPass = 0; // don't show accesspass
    struct AuthSession authSession = requestAuthSession(secsignid, serviceName, serviceAddress, showAccessPass); 

    The structure AuthSession contains the returned parameter ID of the authentication session, SecSign ID, the AccessPass and some more. With every API-function an AuthSession is transmitted and the updated version is returned.

    If an AccessPass is displayed, the base64 coded PNG image can be generated with ImageMagick. The user needs to compare the displayed image with the ones displayed on his smartphone and accepts the session by choosing the correct one.
    If no AccessPass may be displayed the base64-coded PNG image is still sent from the server but can be ignored. The user can accept or deny the login on his phone, but no AccessPass is displayed.

    The session information need to be saved as AuthSession to retain the session status later. The structure of AuthSession includes the following information:

    struct AuthSession {
        char authSessionId[50]; //Session ID 
        char serviceName[50]; //Service name 
        char secSignId[50]; //User name
        char authSessionState; //Authentication status
        char serviceAddress[100]; //IP-address or project URL
        char requestId[100]; //request ID
        char authSessionIconData[4000]; // Accesspass as Base64 PNG

    5. Request the state of the session

    The session requested from the server can take on different status. As soon as the session is accepted at the server it takes on the status ‘pending’. When the user wants to accept the session on his phone it takes on the status ‘fetched’. After the correct symbol was selected the status switches to ‘authenticated’.
    In addition, the status may state ‘denied’, ‘canceled’, ‘expired’ or ‘suspended’. More information about these status can be found in the SecSign ID Server API Documentation.

    A reaction to the status ‘authenticated’ or ‘denied’ is necessary. This can be achieved either by action of the user or via polling (continuous request of the status by the client). If a status is received from the server, a corresponding action is required.

    do {
      authSession = getAuthSessionState(authSession);
      //authentication successful
      if(authSession.authSessionState == SECSIGN_ACCEPTED){
        //refresh authSession and release session
        authSession = releaseAuthSession(authSession);
        // ... additional login methods ...
        return 1;
      else if(authSession.authSessionState == SECSIGN_DENIED){
        return 0;
    } while (1);

    6. Cancellation of the session

    If the client should cancel the session one can use the function ‘cancelAuthSession’.

    authSession = cancelAuthSessionState(authSession); 

    7. Possible Applications

    The main advantage of the native C-API is the use for PAM (pluggable authentication module). This way the SecSign ID can be used to secure SSH connections or user logins at Unix or Mac desktop with a two step Two-Factor Authentication.

    8. Available APIS

    We provide an ever growing list of APIs and plugins to easily integrate the SecSign ID Two-Factor Authentication in any project. An overview is available at Plugin and APIs.
    We do not only offer APIs in different programming languages but also plugins for CMS, Server and VPN environments, oAuth2 and many more. These plugins use our APIs and offer additional functionalities, for example user management, easy and native installation, logging or integration in firewalls or Active Directory.

    The JIRA plugin for example uses the JAVA-API. The PHP-Api and JS-API is used by WordPress, Joomla, Drupal, Typo3 and many more. The is used for the Windows and Cisco VPN and the C-API is used for protecting Unix SSH services. The Objective-C API is used by our AppleTV and iPhone/iPad apps.


    9. See for yourself

    You can experience the SecSign ID two-factor authentication and the two-factor login by simply integrating the plugin into your website or test environment. Or you can try out the login process on our website without having to register first. You already have a SecSign ID or you want one? Login now and use the portal or use our hassle free registration.

    See for yourself how fast and convenient the login process using challenge-response authentication with 2048-bit key pairs is. There is no need for passwords, and no passwords or other confidential information are ever transmitted. It is easy to integrate and simple to use.

    For more information about the patented SafeKey procedure and it's unique security can be found here.

    If you are missing an API for the programming language you are working with, feel free to contact us and we’ll find a solution with you. If you need help with the integration into an existing system or you can’t find the plugin for your content management system you are working with, don’t hesitate to contact our support team.

    Your own ID-Server

    On premise installations of SecSign ID offer the flexibility to connect with your preferred servers, services, and devices. And you can customize the SecSign ID with your own organization’s branding.


    Why upgrade to SecSign?

    On-premise or in the cloud

    Choose between our SecSign ID Cloud or operate your own on-premise Two-Factor Authentication server.

    Easy customization

    Operate your own YourBrand ID app - Two-Factor Authentication customized to your needs.

    Ready-to-use SDK

    Integrate SecSign ID Two-Factor Authentication in existing apps with our ready-to-use SDK.

    Easy user management

    Use the Two-Factor Authentication Server to secure your company Active Directory/LDAP. Your own Identity and Access Management System, for example for mandatory updates and additional security features.

    Cover all logins

    Integration in any login environment: web, local, VPN, remote desktop, mobile logins and many more.

    Plugins for all your needs

    No need for complex integration: we have plugins for almost all environments.

    SecSign 2FA