> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Modify smart credential authenticator settings

Before you assign smart credentials to users, review smart credential authenticator settings and update them as needed. You can also change these settings after assignment. Changes apply to all smart credentials assigned in your IDaaS account.

IMPORTANT

You must complete the prerequisites before you can create smart credentials. See [Manage smart credentials](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials.md).

## Modify smart credential authenticator settings

Complete these steps to configure smart credential authenticator settings:

1. Click Menu icon **>** **Policies** **> Authenticators**. The **Authenticators** page appears.

2. Select **Smart Credential**. The **Smart Credential** settings appear.

3. Set **PIN Prompt** to **Session** or **Transaction**. This setting defines when the smart credential app prompts users for their PIN during authentication.

4. Select the **Hardware Store** setting to store generated keys in hardware as follows:

   1. Select **Required** to store the generated keys in hardware storage. If you select **Required**, a **StrongBox** checkbox appears.
   2. Select **StrongBox** to require that Android keys on the device are generated by StrongBox keymaster.
   3. Select **Best Option** to allow the device to choose the most secure available storage for generated keys.

note
The **Required** option does not support RSA keys on iOS. In addition, Secure Enclave (iOS hardware storage) supports only _NIST_ Curve P-256.

5. By default, **Application Launch Scheme** is set to `igmobilesc`. If you use a custom mobile smart credential app, enter the URL scheme used in that app's activation URL.

6. Set **Session Timeout (min)** to the number of minutes a user has to respond to a smart credential authentication challenge. The allowed range is `1` to `2` minutes.

7. Select **Allow Unsecure Device** to allow the mobile smart credential app to run on devices where operating system restrictions have been bypassed.

8. Select **Allow Fingerprint Authentication** to allow the mobile smart credential app to accept fingerprint authentication instead of a PIN.

note
Device fingerprint authentication can allow fallback to the device PIN. That PIN can be shorter (`4` digits) than the card PIN (`8` digits). For more information, see [Manage device fingerprint attributes](/docs/authentication-and-security/manage-authenticators/manage-device-fingerprint-attributes.md).

9. Select **Change PIN After Activation** to require users to change their card PIN after they activate the smart credential app in their IDaaS account. This option is selected (`true`) by default.

10. Select **Allow the mobile application to accept facial recognition authentication instead of PIN** to allow facial recognition instead of a PIN.

11. Set **Activation Password Length** to the number of digits required for the mobile smart credential activation password.

12. Set **Activation Lifetime (min)** to the number of minutes a user has to activate their mobile smart credential.

13. Select **Allowed Smart Credentials Definitions** from the drop-down list. You can select more than one. At least one smart credential definition is required to create a smart credential authenticator.

14. Click **Save** to confirm the changes.

## Validate your changes

After you save, verify the following:

1. Updated settings are retained after page refresh.
2. Allowed smart credential definitions match your deployment requirements.
3. A test user can complete authentication with the expected PIN and biometric behavior.