Cbox ID Authenticator

A companion app for Cbox ID: approve agent requests and sign-ins from your phone, and see security alerts on your account.

Built with NativePHP for Mobile v4 — real SwiftUI and Jetpack Compose rendered from PHP, no web view.

What it does

Cbox ID's OAuth server implements CIBA (Client-Initiated Backchannel Authentication): an agent asks to act on your behalf, and you approve it out of band. The server has always been able to ask; this app is what tells you.

• A push arrives when an approval is waiting.
• The approval screen shows the binding message — the transaction description you compare against what the requesting app told you. That comparison is the anti-phishing control, so the message is fetched over TLS after the app opens and is deliberately never in the push payload: a lock screen is readable by anyone holding the phone.
• Approve, deny, or report the request as not yours.

What it is not

It is not stronger 2FA than the passkeys Cbox ID already supports, and should not be sold as such.

Biometrics::prompt() returns a boolean over the NativePHP bridge — no challenge in, no signature out, no attestation. The biometric gate stops someone holding your unlocked phone, and nothing more. The DPoP key is generated by ext-openssl and kept in the platform keystore, which protects it at rest but does not make it non-exportable.

That puts this slightly above Authy and Duo Push — they carry bearer tokens, this carries a sender-constrained one — and clearly below a WebAuthn platform authenticator. Its real value is being a decoupled approval surface on a second device, which a passkey does not give you.

app/Services/DpopKey.php says the same thing next to the code.

Status

Working: native UI, the plugin bridge, deep links from cold start, the device and approvals API client, DPoP proof minting with clock-offset correction.

Not yet verified: the sign-in flow end to end. Browser::auth()'s callback delivery has not been exercised against a running host, so enrolment from a real handset is unproven.

Requirements

• PHP 8.4+, and macOS with Xcode for iOS builds
• NativePHP for Mobile v4 (dev-main from nativephp/mobile-air) and nativephp/mobile-ui from nativephp/native-ui — neither is on Packagist
• The paid plugins mobile-firebase, mobile-biometrics, mobile-secure-storage and mobile-scanner, which need marketplace credentials in your global Composer auth.json — never in this repo

composer install
php artisan native:install ios     # or android
php artisan native:run ios

pod install needs a UTF-8 locale; prefix with LANG=en_US.UTF-8 if it fails.

Licence

Not yet chosen. Until one is added, default copyright applies — all rights reserved.