# Component interoperability

Keyless currently consists of three main product components:

<table><thead><tr><th width="284">Component</th><th width="240">Facilitates User Enrollment</th><th>Enables authentication</th></tr></thead><tbody><tr><td>IDV Bridge (OnPremise or Saas)</td><td>✅</td><td>❌</td></tr><tr><td>Mobile SDK</td><td>✅</td><td>✅</td></tr><tr><td>Web SDK</td><td>✅</td><td>✅</td></tr></tbody></table>

### **Interoperability between Keyless components**

All these components can now operate in an interconnected manner. A user can complete the enrollment process on any of these components and later authenticate on a different component without needing to re-enroll.

The technology enabling this seamless interoperability is called the **Keyless Client State**.

#### **How Keyless Client State Works**

The Keyless Client State can be generated by any of the components listed above.

* It can then be consumed by either the Web SDK or Mobile SDK to enable cross-platform authentication. Client state is then used to authenticate:
  * On **Mobile SDK**, where a new client state will then be created on this device and for this specific UserID to allow for on-going authentication of that user from that device.
  * On **Web SDK** where a new client state will be stored on the Keyless server for this specific UserID to allow for on-going authentication from any browser where the customer chooses to initiate Keyless as a 2nd factor for authentication.

This interoperability opens up various use cases for Keyless authentication.

#### **Possible Scenarios relating to interoperability**

1. **Live Enrollment  -> cross-platform authentication**

Users enroll into Keyless by taking a selfie via a Keyless UI deployed by our customers into their own Mobile or Web apps via our SDKs.

* [Enroll users through the Web SDK](https://docs.keyless.io/web-sdk/web-sdk-guide/enrollment) and then activate them in your Mobile app at a later stage to authenticate there without the need to re-enroll.
* [Enroll users on the Mobile SDK](https://docs.keyless.io/consumer/mobile-sdk-guide/enrollment) and authenticate them in your web application (again without any re-enrollment).

2. **IDV Bridge  -> cross-platform authentication**

Customers have captured a selfie, typically during KYC/Onboarding flows, and enroll this image into Keyless via:

* **On-Premise** - enroll user selfies via the "Keyless Agent” component installed inside their own infrastructure, and subsequently allow them to authenticate via your web or mobile app at a later date using client state.
  * This option ensures that the selfies stay within your own infrastructure and therefore the entire process remains 100% privacy preserving.
* **SaaS** - enroll user selfies via our [authentication service api](/idv-bridge/readme/idv-bridge-saas.md), whereby the UserID is created instantly and client state can be stored to subsequently authenticate via your web or mobile app.
  * The selfie is sent to a Secure Enclave in Keyless and instantly transformed into a cryptographic key. No biometric data or Pii is then stored.

#### **Further technical resources**

1. **Enroll via IDV Bridge On-Premise -> authenticate via Web SDK**

   We have created a [tutorial for integrators](https://docs.keyless.io/idv-bridge/readme/idv-bridge-on-premise/keyless-on-premise-enrollment-greater-than-web-sdk-authentication-tutorial) who want to enroll user selfies captured outside of Keyless using IDV Bridge On-Premise and then allow those same users to authenticate on their web app/SDK.&#x20;
2. **Enroll via Web SDK or IDV Bridge** **(On-Premise or SaaS) -> authenticate via Mobile SDK**&#x20;

   Where customers have enrolled via Web SDK or IDV Bridge, then they must [export the Client State](https://authentication-service.eks.core-production.keyless.technology/redoc#tag/client-state/operation/export_client_state_v1_users__customer___username__export_client_state_post), and then leverage this when the customer attempts to authenticate on a new device via the Mobile SDK. Use the [account recovery](https://docs.keyless.io/consumer/mobile-sdk-use-cases/guide-account-recovery) for guidance on authenticating users on a new device, thus enabling on-going authentication.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keyless.io/idv-bridge/component-interoperability.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.